VIRY.CZ

log z rsit

Logfile of random's system information tool 1.10 (written by random/random)
Run by jiří at 2015-12-28 20:19:48
Microsoft Windows 8.1 s aplikací Bing
System drive C: has 358 GB (82%) free of 435 GB
Total RAM: 3979 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:19:52, on 28. 12. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.18123)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE
C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe
C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe
C:\Program Files\trend micro\jiří.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCJB
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\RunOnce: [Application Restart #3] C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side-phishing-detection --enable-file-cookies --disable-sync --disable-breakpad --disable-bundled-ppapi-flash --disable-sync-tabs --disable-speech-input --disable-custom-jumplist --process-per-tab --debug-devtools-frontend="C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\inspector" --no-first-run --lang=en-US --disable-component-update --disable-prompt-on-repost --no-startup-window --disable-translate --disable-logging --disable-desktop-notifications --disable-gpu-process-prelaunch --flag-switches-begin --flag-switches-end --restore-last-session
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - https://fpdownload.macromedia.com/pub/s ... tor/sw.cab
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Bluetooth Device Monitor - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
O23 - Service: Bluetooth OBEX Service - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @C:\windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel Bluetooth Service (iBtSiva) - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService1.0.0.0) - Unknown owner - C:\windows\system32\igfxCUIService.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo EasyPlus Hotspot - Lenovo - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe
O23 - Service: Lenovo System Agent Service - LENOVO INCORPORATED. - C:\Program Files\Lenovo\iMController\SystemAgentService.exe
O23 - Service: Lenovo WiFiHotspot Service (LenovoWiFiHotspotSvr) - Unknown owner - C:\Windows\System32\LenovoWiFiHotspotSvr.exe (file missing)
O23 - Service: LSCWinService - Lenovo - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
O23 - Service: LUService - Lenovo(beijing) Limited - C:\Program Files (x86)\Lenovo\Lenovo Updates\LUService.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo PhoneCompanionPusher Service (PhoneCompanionPusher) - Lenovo - C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe
O23 - Service: Lenovo PhoneCompanionVap Service (PhoneCompanionVap) - Lenovo - C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Cyberlink RichVideo64 Service(CRVS) (RichVideo64) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Conexant SmartAudio service (SAService) - Conexant Systems, Inc. - C:\windows\system32\SAsrv.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: VeriFaceSrv - Unknown owner - C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

--
End of file - 9835 bytes

======Listing Processes======





wininit.exe

winlogon.exe

C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
"dwm.exe"
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\igfxCUIService.exe
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\WLANExt.exe 470511082064
\??\C:\windows\system32\conhost.exe 0x4
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\windows\system32\CxAudMsg64.exe
C:\windows\System32\svchost.exe -k utcsvc
"C:\Program Files\Intel\WiFi\bin\EvtEng.exe"
"C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe"
"C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe"
"C:\Program Files\Lenovo\iMController\SystemAgentService.exe"
C:\Windows\System32\LenovoWiFiHotspotSvr.exe
"C:\Program Files (x86)\Lenovo\Lenovo Updates\LUService.exe"
"C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe"
"C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe"
"C:\Program Files\CyberLink\Shared files\RichVideo64.exe"
C:\windows\SysWOW64\SAsrv.exe
C:\windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe"
"C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe"
C:\windows\system32\wbem\unsecapp.exe -Embedding
C:\windows\system32\wbem\wmiprvse.exe
dashost.exe {e1042eb6-6b3f-42b5-aab7381761b7bd48}
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-458ba41a-dee4-49e0-95ba-8c2977447905 -SystemEventPortName:HostProcess-fbe0971c-c11e-4323-99ee-0b4cbe05ca1e -IoCancelEventPortName:HostProcess-62071174-c9d0-4633-bdce-bb64f3822f3f -NonStateChangingEventPortName:HostProcess-416ac537-9561-41a5-98f2-e3663708ee43 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:74194c0b-1281-4adf-8405-708da1a429f4 -DeviceGroupId:WudfDefaultDevicePool
"C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe"
"C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe"
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
"C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe"
C:\windows\system32\SearchIndexer.exe /Embedding
C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\windows\Explorer.EXE
taskhostex.exe
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
C:\Windows\System32\skydrive.exe -Embedding
igfxHK.exe
igfxTray.exe
"C:\windows\system32\igfxEM.exe" -Embedding
"C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\ServiceHostAppUpdater.exe" /LOGON
"C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe"
"C:\windows\system32\GWX\GWX.exe"
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
"C:\Windows\RTFTrack.exe"
"C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe"
"C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe"
"C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe"
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE"
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
"C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe" /showasync
"C:\Windows\System32\SettingSyncHost.exe" -Embedding
"C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe"
"C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe" --type=renderer --disable-breakpad --disable-desktop-notifications --disable-logging --disable-speech-input --lang=en-US --force-fieldtrials=AsyncDns/disabled/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/ForceCompositingMode/disable/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/InfiniteCache/No/OmniboxDisallowInlineHQP/Standard/OmniboxSearchSuggest/17/OneClickSignIn/BlueOnWhite/Prefetch/ContentPrefetchPrefetchOff/Prerender/Prerender15minTTL/ProxyConnectionImpact/proxy_connections_32/SBInterstitial/V1/SpdyCwnd/cwnd10/SpeculativePrefetchingLearning/SpeculativePrefetchingLearningEnabled/Test0PercentDefault/default/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_11/UMA-Uniformity-Trial-1-Percent/default/UMA-Uniformity-Trial-10-Percent/default/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/default/UMA-Uniformity-Trial-50-Percent/group_01/WarmSocketImpact/warm_socket/ --noerrdialogs --disable-client-side-phishing-detection --disable-bundled-ppapi-flash --channel="668.2.343581144\1410647815" /prefetch:3
"C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\ServiceStartMenuIndexer.exe"
C:\windows\system32\rundll32.exe C:\windows\system32\pla.dll,PlaHost "LSC Memory" "0xf2c_0x164_0x5c23ee06"
adb fork-server server

"C:\Program Files\Windows Defender\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey F7278A28-CDCB-2FE2-7DBB-5485D26294EF -Reinvoke
C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\windows\system32\wbem\wmiprvse.exe
taskhost.exe
"C:\Program Files\WindowsApps\Microsoft.BingTranslator_1.14.0.0_x64__8wekyb3d8bbwe\Translator.exe" -ServerName:App.AppX3vmvb5n7qghk9jcbrp01a7p45wq7rxe1.mca
C:\windows\System32\svchost.exe -k WerSvcGroup
"C:\Users\jiří\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-12-23 256456]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-12-23 194504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-12-23 256456]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-12-23 194504]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"cAudioFilterAgent"=C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [2013-09-05 907480]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SACpl.exe [2012-06-13 1647616]
"BTMTrayAgent"=C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [2013-11-07 7818552]
"RtsFT"=C:\windows\RTFTrack.exe [2014-01-21 6340312]
"PhoneCompanion"=C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe [2014-09-19 836592]
"Energy Manager"=C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [2014-09-19 16094704]
"Lenovo Utility"=C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [2014-09-19 10841584]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-02-19 7416088]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2015-06-29 53282944]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Application Restart #3"=C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe [2015-10-30 7875640]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"UpdateP2GShortCut"=C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [2011-12-07 214312]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcpltsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDWFP]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoRun"=0
"NoFolderOptions"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-12-28 20:13:01 ----D---- C:\Program Files\trend micro
2015-12-28 20:13:00 ----D---- C:\rsit
2015-12-28 19:56:25 ----D---- C:\windows\system32\drivers\N360x64
2015-12-28 19:56:23 ----D---- C:\Program Files (x86)\Norton 360
2015-12-28 19:54:48 ----D---- C:\Users\jiří\AppData\Roaming\WinRAR
2015-12-28 19:49:31 ----D---- C:\Program Files\WinRAR
2015-12-28 19:35:16 ----SHD---- C:\Config.Msi
2015-12-24 19:12:44 ----D---- C:\windows\LastGood.Tmp
2015-12-18 14:05:08 ----A---- C:\windows\system32\aspnet_counters.dll
2015-12-18 14:05:05 ----A---- C:\windows\SYSWOW64\aspnet_counters.dll
2015-12-13 16:54:46 ----D---- C:\Program Files\Common Files\AV
2015-12-09 17:23:47 ----A---- C:\windows\system32\drivers\rmcast.sys
2015-12-09 17:23:01 ----A---- C:\windows\system32\msfeeds.dll
2015-12-09 17:23:00 ----A---- C:\windows\SYSWOW64\ieframe.dll
2015-12-09 17:22:59 ----A---- C:\windows\system32\ieframe.dll
2015-12-09 17:22:58 ----A---- C:\windows\SYSWOW64\vbscript.dll
2015-12-09 17:22:58 ----A---- C:\windows\SYSWOW64\jscript9.dll
2015-12-09 17:22:58 ----A---- C:\windows\SYSWOW64\jscript.dll
2015-12-09 17:22:58 ----A---- C:\windows\system32\vbscript.dll
2015-12-09 17:22:55 ----A---- C:\windows\SYSWOW64\ieapfltr.dll
2015-12-09 17:22:54 ----A---- C:\windows\SYSWOW64\wininet.dll
2015-12-09 17:22:54 ----A---- C:\windows\SYSWOW64\inetcomm.dll
2015-12-09 17:22:54 ----A---- C:\windows\system32\jscript9.dll
2015-12-09 17:22:54 ----A---- C:\windows\system32\jscript.dll
2015-12-09 17:22:53 ----A---- C:\windows\system32\inetcomm.dll
2015-12-09 17:22:53 ----A---- C:\windows\system32\ieapfltr.dll
2015-12-09 17:22:52 ----A---- C:\windows\system32\wininet.dll
2015-12-09 17:22:52 ----A---- C:\windows\system32\mshtml.dll
2015-12-09 17:22:50 ----A---- C:\windows\SYSWOW64\iertutil.dll
2015-12-09 17:22:50 ----A---- C:\windows\system32\iertutil.dll
2015-12-09 17:22:49 ----A---- C:\windows\SYSWOW64\mshtml.dll
2015-12-09 17:22:24 ----A---- C:\windows\SYSWOW64\urlmon.dll
2015-12-09 17:22:24 ----A---- C:\windows\system32\urlmon.dll
2015-12-09 17:22:23 ----A---- C:\windows\SYSWOW64\msfeeds.dll
2015-12-09 17:22:22 ----A---- C:\windows\SYSWOW64\ieui.dll
2015-12-09 17:22:22 ----A---- C:\windows\system32\ieui.dll
2015-12-09 17:22:22 ----A---- C:\windows\system32\ie4uinit.exe
2015-12-09 17:22:21 ----A---- C:\windows\SYSWOW64\actxprxy.dll
2015-12-09 17:22:20 ----A---- C:\windows\SYSWOW64\iedkcs32.dll
2015-12-09 17:22:20 ----A---- C:\windows\system32\iedkcs32.dll
2015-12-09 17:22:19 ----A---- C:\windows\SYSWOW64\webcheck.dll
2015-12-09 17:22:19 ----A---- C:\windows\system32\webcheck.dll
2015-12-09 17:22:19 ----A---- C:\windows\system32\mshtmled.dll
2015-12-09 17:22:19 ----A---- C:\windows\system32\iepeers.dll
2015-12-09 17:22:19 ----A---- C:\windows\system32\dxtrans.dll
2015-12-09 17:22:18 ----A---- C:\windows\SYSWOW64\MshtmlDac.dll
2015-12-09 17:22:18 ----A---- C:\windows\SYSWOW64\iepeers.dll
2015-12-09 17:22:18 ----A---- C:\windows\SYSWOW64\dxtrans.dll
2015-12-09 17:22:18 ----A---- C:\windows\system32\actxprxy.dll
2015-12-09 17:20:43 ----A---- C:\windows\system32\dpapisrv.dll
2015-12-09 17:20:39 ----A---- C:\windows\system32\ntoskrnl.exe
2015-12-09 17:20:38 ----A---- C:\windows\SYSWOW64\ntvdm64.dll
2015-12-09 17:20:38 ----A---- C:\windows\SYSWOW64\ntdll.dll
2015-12-09 17:20:38 ----A---- C:\windows\SYSWOW64\comsvcs.dll
2015-12-09 17:20:38 ----A---- C:\windows\SYSWOW64\catsrvut.dll
2015-12-09 17:20:38 ----A---- C:\windows\system32\winresume.exe
2015-12-09 17:20:38 ----A---- C:\windows\system32\winload.exe
2015-12-09 17:20:38 ----A---- C:\windows\system32\ntvdm64.dll
2015-12-09 17:20:38 ----A---- C:\windows\system32\ntdll.dll
2015-12-09 17:20:38 ----A---- C:\windows\system32\comsvcs.dll
2015-12-09 17:20:38 ----A---- C:\windows\system32\catsrvut.dll
2015-12-09 17:20:31 ----A---- C:\windows\system32\win32k.sys
2015-12-09 17:20:31 ----A---- C:\windows\system32\user32.dll
2015-12-09 17:20:31 ----A---- C:\windows\system32\GdiPlus.dll
2015-12-09 17:20:31 ----A---- C:\windows\system32\FntCache.dll
2015-12-09 17:20:31 ----A---- C:\windows\system32\DWrite.dll
2015-12-09 17:20:30 ----A---- C:\windows\SYSWOW64\user32.dll
2015-12-09 17:20:30 ----A---- C:\windows\SYSWOW64\GdiPlus.dll
2015-12-09 17:20:30 ----A---- C:\windows\SYSWOW64\DWrite.dll
2015-12-09 17:20:28 ----A---- C:\windows\SYSWOW64\msctf.dll
2015-12-09 17:20:28 ----A---- C:\windows\system32\msctf.dll
2015-12-09 17:19:55 ----A---- C:\windows\SYSWOW64\authui.dll
2015-12-09 17:19:55 ----A---- C:\windows\system32\authui.dll
2015-12-09 17:19:51 ----A---- C:\windows\SYSWOW64\wuapi.dll
2015-12-09 17:19:51 ----A---- C:\windows\system32\wups2.dll
2015-12-09 17:19:51 ----A---- C:\windows\system32\wucltux.dll
2015-12-09 17:19:51 ----A---- C:\windows\system32\wuaueng.dll
2015-12-09 17:19:51 ----A---- C:\windows\system32\wuauclt.exe
2015-12-09 17:19:51 ----A---- C:\windows\system32\wuapi.dll
2015-12-09 17:19:50 ----A---- C:\windows\SYSWOW64\wuwebv.dll
2015-12-09 17:19:50 ----A---- C:\windows\SYSWOW64\wudriver.dll
2015-12-09 17:19:50 ----A---- C:\windows\SYSWOW64\wuapp.exe
2015-12-09 17:19:50 ----A---- C:\windows\system32\wuwebv.dll
2015-12-09 17:19:50 ----A---- C:\windows\system32\WUSettingsProvider.dll
2015-12-09 17:19:50 ----A---- C:\windows\system32\wudriver.dll
2015-12-09 17:19:50 ----A---- C:\windows\system32\wuapp.exe
2015-12-09 17:19:44 ----A---- C:\windows\SYSWOW64\PCPKsp.dll
2015-12-09 17:19:44 ----A---- C:\windows\system32\PCPKsp.dll
2015-12-09 17:19:43 ----A---- C:\windows\system32\drivers\winusb.sys
2015-12-09 17:19:43 ----A---- C:\windows\system32\drivers\usbuhci.sys
2015-12-09 17:19:43 ----A---- C:\windows\system32\drivers\usbport.sys
2015-12-09 17:19:43 ----A---- C:\windows\system32\drivers\usbohci.sys
2015-12-09 17:19:43 ----A---- C:\windows\system32\drivers\USBHUB3.SYS
2015-12-09 17:19:43 ----A---- C:\windows\system32\drivers\usbhub.sys
2015-12-09 17:19:43 ----A---- C:\windows\system32\drivers\usbehci.sys
2015-12-09 17:19:43 ----A---- C:\windows\system32\drivers\usbd.sys
2015-12-09 17:19:38 ----A---- C:\windows\system32\winlogon.exe
2015-12-09 17:19:38 ----A---- C:\windows\system32\wininit.exe

======List of files/folders modified in the last 1 month======

2015-12-28 20:18:53 ----D---- C:\windows\Prefetch
2015-12-28 20:15:38 ----RD---- C:\Program Files (x86)
2015-12-28 20:14:57 ----D---- C:\windows\system32\drivers
2015-12-28 20:14:57 ----D---- C:\Program Files\Common Files
2015-12-28 20:14:52 ----D---- C:\windows\system32\Tasks
2015-12-28 20:14:43 ----SHD---- C:\System Volume Information
2015-12-28 20:13:01 ----RD---- C:\Program Files
2015-12-28 20:12:15 ----D---- C:\windows\Temp
2015-12-28 20:00:05 ----D---- C:\windows\system32\sru
2015-12-28 19:58:54 ----HD---- C:\windows\ELAMBKUP
2015-12-28 19:56:23 ----D---- C:\ProgramData\Norton
2015-12-28 19:51:02 ----D---- C:\ProgramData\LU
2015-12-28 19:48:10 ----D---- C:\windows\Tasks
2015-12-28 19:45:24 ----D---- C:\Users\jiří\AppData\Roaming\Skype
2015-12-28 19:40:10 ----AD---- C:\Windows
2015-12-28 19:38:16 ----SHD---- C:\windows\Installer
2015-12-28 19:36:00 ----RSD---- C:\windows\assembly
2015-12-28 19:35:51 ----D---- C:\Users\jiří\AppData\Roaming\LSC
2015-12-28 19:35:40 ----D---- C:\Program Files\Lenovo
2015-12-28 19:33:12 ----D---- C:\windows\Downloaded Installations
2015-12-28 19:27:09 ----D---- C:\ProgramData\NortonInstaller
2015-12-28 16:26:12 ----D---- C:\windows\rescache
2015-12-28 16:22:08 ----D---- C:\windows\debug
2015-12-28 16:13:15 ----D---- C:\windows\Inf
2015-12-28 15:19:34 ----D---- C:\windows\Microsoft.NET
2015-12-25 09:48:26 ----RAD---- C:\windows\System32
2015-12-24 21:22:27 ----A---- C:\windows\system32\PerfStringBackup.INI
2015-12-24 17:37:57 ----D---- C:\windows\AppReadiness
2015-12-24 17:14:52 ----D---- C:\windows\system32\config
2015-12-24 16:57:00 ----D---- C:\windows\CbsTemp
2015-12-24 16:56:57 ----D---- C:\windows\WinSxS
2015-12-24 06:55:06 ----SD---- C:\windows\SYSWOW64\GWX
2015-12-24 06:55:06 ----SD---- C:\windows\system32\GWX
2015-12-24 06:55:06 ----D---- C:\windows\SysWOW64
2015-12-23 14:58:50 ----D---- C:\windows\SoftwareDistribution
2015-12-22 20:03:26 ----HD---- C:\Program Files\WindowsApps
2015-12-13 16:43:26 ----D---- C:\windows\SYSWOW64\en-US
2015-12-13 16:43:26 ----D---- C:\windows\SYSWOW64\cs-CZ
2015-12-13 16:43:26 ----D---- C:\windows\system32\en-US
2015-12-13 16:43:26 ----D---- C:\windows\system32\cs-CZ
2015-12-13 16:43:25 ----D---- C:\Program Files\Internet Explorer
2015-12-13 16:43:25 ----D---- C:\Program Files (x86)\Internet Explorer
2015-12-13 16:43:20 ----D---- C:\windows\system32\DriverStore
2015-12-10 12:39:54 ----D---- C:\windows\system32\MRT
2015-12-10 12:34:10 ----A---- C:\windows\system32\MRT.exe
2015-12-09 17:18:34 ----D---- C:\windows\system32\catroot2
2015-12-09 04:39:31 ----N---- C:\windows\system32\MpSigStub.exe
2015-12-01 18:19:27 ----A---- C:\windows\SYSWOW64\FlashPlayerApp.exe
2015-11-30 19:02:31 ----D---- C:\ProgramData\McAfee
2015-11-30 19:02:31 ----D---- C:\Program Files (x86)\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MBI;@oem10.inf,%MBI.SVCDESC%;Intel(R) Sideband Fabric Device Service; C:\windows\System32\drivers\MBI.sys [2013-10-10 29464]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\windows\system32\DRIVERS\vwififlt.sys [2014-04-30 71680]
R3 ACPIVPC;@oem37.inf,%ACPIVPC.SvcDesc%;Lenovo Virtual Power Controller Driver; C:\windows\System32\drivers\AcpiVpc.sys [2014-09-19 35576]
R3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys [2014-10-29 81920]
R3 btmhsf;btmhsf; C:\windows\system32\DRIVERS\btmhsf.sys [2013-11-07 1411384]
R3 CnxtHdAudService;@oem11.inf,%UAAFunctionDriverForHdAudio.SvcDesc%;Conexant UAA Function Driver for High Definition Audio Service; C:\windows\system32\drivers\CHDRT64.sys [2014-01-27 1474240]
R3 ibtusb;@oem16.inf,%ibtusb.SVCDESC_IBT%;Intel(R) Wireless Bluetooth(R) 4.0 + HS Adapter; C:\windows\system32\DRIVERS\ibtusb.sys [2014-01-22 149448]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2014-03-07 3729920]
R3 IntcDAud;@oem4.inf,%IntcDAud.SvcDesc%;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2014-03-07 450520]
R3 iwdbus;@oem7.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\windows\System32\drivers\iwdbus.sys [2014-03-01 27032]
R3 NETwNb64;@oem17.inf,___ %NIC_Service_DispName_WINB_64%;___ Intel(R) Wireless Adapter Driver for Windows 8.1 - 64 Bit; C:\windows\system32\DRIVERS\Netwbw02.sys [2014-06-01 3443680]
R3 RSUSBVSTOR;@oem35.inf,%RSUSBVSTOR.SvcDesc%;RtsUVStor.Sys Realtek USB Card Reader; C:\windows\System32\Drivers\RtsUVStor.sys [2013-09-24 329944]
R3 RTL8168;@oem8.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\windows\system32\DRIVERS\Rt630x64.sys [2013-08-15 830680]
R3 rtsuvc;@oem25.inf,%rtsuvc.DeviceDesc%;Lenovo EasyCamera; C:\windows\system32\DRIVERS\rtsuvc.sys [2014-01-21 9105624]
R3 SmbDrvI;SmbDrvI; C:\windows\system32\DRIVERS\Smb_driver_Intel.sys [2013-12-24 34544]
R3 SynTP;@oem13.inf,%SynTP.SvcDesc%;Synaptics TouchPad Driver; C:\windows\system32\DRIVERS\SynTP.sys [2013-12-24 532720]
R3 TXEIx64;@oem9.inf,%TEE_SvcDesc%;Intel(R) Trusted Execution Engine Interface ; C:\windows\System32\drivers\TXEIx64.sys [2014-01-15 88592]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\windows\system32\DRIVERS\vwifimp.sys [2014-04-30 38912]
R4 ccSet_N360;N360 Settings Manager; C:\windows\system32\drivers\N360x64\1501000.012\ccSetx64.sys []
R4 IDSVia64;IDSVia64; \??\C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20130930.001\IDSVia64.sys []
R4 SRTSPX;Symantec Real Time Storage Protection (PEL) x64; C:\windows\system32\drivers\N360x64\1501000.012\SRTSPX64.SYS []
R4 SymDS;Symantec Data Store; C:\windows\system32\drivers\N360x64\1501000.012\SYMDS64.SYS []
R4 SymEFA;Symantec Extended File Attributes; C:\windows\system32\drivers\N360x64\1501000.012\SYMEFA64.SYS []
R4 SymEvent;SymEvent; \??\C:\windows\system32\Drivers\SYMEVENT64x86.SYS []
S3 BthEnum;@bth.inf,%BthEnum.SVCDESC%;Bluetooth Enumerator Service; C:\windows\System32\drivers\BthEnum.sys [2014-10-29 53248]
S3 BthLEEnum;@bthleenum.inf,%BthLEEnum.SVCDESC%;Bluetooth Low Energy Driver; C:\windows\system32\DRIVERS\BthLEEnum.sys [2014-03-18 226304]
S3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Bluetooth Device (Personal Area Network); C:\windows\System32\drivers\bthpan.sys [2015-07-10 118272]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys [2015-05-11 1201664]
S3 btmaux;@oem15.inf,%BTMAUX.ServiceDesc%;Intel Bluetooth Auxiliary Service; C:\windows\system32\DRIVERS\btmaux.sys [2013-11-07 140600]
S3 e1iexpress;@net1ic64.inf,%e1iExpress.Service.DispName%;Intel(R) PRO/1000 PCI Express Network Connection Driver I; C:\windows\system32\DRIVERS\e1i63x64.sys [2013-06-18 460288]
S3 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [2015-11-26 498512]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2015-11-30 157520]
S3 intaud_WaveExtensible;@oem6.inf,%INTAUD_WEX.SvcDesc%;Intel WiDi Audio Device; C:\windows\system32\drivers\intelaud.sys [2014-03-01 38296]
S3 NETwNe64;@netwew02.inf,___ %NIC_Service_DispName_WIN8_64%;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 8 - 64 Bit; C:\windows\system32\DRIVERS\NETwew02.sys [2013-06-18 4649440]
S3 RFCOMM;@tdibth.inf,%RFCOMM.DisplayName%;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\System32\drivers\rfcomm.sys [2015-01-30 167424]
S3 usbaudio;@wdma_usb.inf,%USBAudio.SvcDesc%;Ovladač zvuků USB (WDM); C:\windows\system32\drivers\usbaudio.sys [2014-03-18 121088]
S3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;USB Video Device (WDM); C:\windows\System32\Drivers\usbvideo.sys [2014-06-21 212736]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bluetooth Device Monitor;Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2013-11-07 1186168]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2013-11-07 1161592]
R2 CxAudMsg;@C:\windows\system32\CxAudMsg64.exe,-100; C:\windows\system32\CxAudMsg64.exe [2013-07-25 206552]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\windows\System32\svchost.exe [2014-10-29 38792]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2014-01-18 632048]
R2 iBtSiva;Intel Bluetooth Service; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [2014-01-22 130008]
R2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service; C:\windows\system32\igfxCUIService.exe [2014-03-12 282096]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [2013-07-02 733696]
R2 Lenovo System Agent Service;Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [2014-05-22 584960]
R2 LenovoWiFiHotspotSvr;Lenovo WiFiHotspot Service; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [2014-09-19 198192]
R2 LUService;LUService; C:\Program Files (x86)\Lenovo\Lenovo Updates\LUService.exe [2014-02-18 38896]
R2 PhoneCompanionPusher;Lenovo PhoneCompanionPusher Service; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe [2014-09-19 288240]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2014-01-18 154864]
R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo64.exe [2012-04-24 390632]
R2 SAService;Conexant SmartAudio service; C:\windows\system32\SAsrv.exe []
R2 VeriFaceSrv;VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe [2014-09-19 67856]
R3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2014-03-18 43696]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-08 107848]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-06-03 327296]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\windows\System32\svchost.exe [2014-10-29 38792]
S3 cphs;Intel(R) Content Protection HECI Service; C:\windows\SysWow64\IntelCpHeciSvc.exe [2014-03-12 279024]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-08 107848]
S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2015-07-28 194032]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2012-04-24 169752]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [2013-07-02 822232]
S3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [2014-06-03 533760]
S3 LSCWinService;LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [2015-12-10 272864]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2014-01-18 284912]
S3 PhoneCompanionVap;Lenovo PhoneCompanionVap Service; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe [2014-09-19 305136]

-----------------EOF-----------------

Krasny den Vam preju



V ramci cisteni Vam budou vyprazdneny docasne adresare (vcetne Kose).

Ulozte na plochu AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/ (nebo http://www.bleepingcomputer.com/download/adwcleaner/ )

• ukoncete vsechny programy
• kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
• kliknete na Scan, pote na Cleaning
• po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\AdwCleaner[Cx].txt), jehoz obsah mi zkopirujte do pristi odpovedi

# AdwCleaner v5.026 - Logfile created 29/12/2015 at 05:38:51
# Updated 21/12/2015 by Xplode
# Database : 2015-12-23.1 [Server]
# Operating system : Windows 8.1 Connected (x64)
# Username : jiří - LENOVO-PC
# Running from : C:\Users\jiří\Desktop\adwcleaner_5.026.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\ProgramData\pokki

***** [ Files ] *****

[-] File Deleted : C:\windows\SysNative\VisualDiscoveryOff.ini
[-] File Deleted : C:\windows\SysWOW64\VisualDiscovery.ini
[-] File Deleted : C:\windows\SysWOW64\VisualDiscoveryOff.ini

***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\Classes\pokki
[-] Key Deleted : HKCU\Software\Classes\AllFileSystemObjects\shell\pokki
[-] Key Deleted : HKCU\Software\Classes\Directory\shell\pokki
[-] Key Deleted : HKCU\Software\Classes\Drive\shell\pokki
[-] Key Deleted : HKCU\Software\Classes\lnkfile\shell\pokki
[-] Key Deleted : HKLM\SOFTWARE\CLASSES\APPID\VISUALDISCOVERY.EXE
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki_04bb6df446330549a2cb8d67fbd1a745025b7bd1
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2E5FA7B4-61A2-4662-BBCE-62BBB20FC649}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5D7F05E3-075A-43AF-8BC7-21E2F7F38845}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{617E26CE-E6E1-4C75-A68A-A001F2B98491}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FBDBEA-A722-4ABD-BEC0-B7D463F6BA0E}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8128586C-DF69-4266-873F-CF4C6F705A7C}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C1F9CFCE-A7DC-4072-8B31-1DEA57004C86}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EA4AD895-2A7F-430E-B973-DEE6C4E743A9}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EBF4B60F-A863-426F-BE6F-5DFE83BC574F}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{CB6BF8B6-E12B-42FA-A478-91BCCDE475DC}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2E5FA7B4-61A2-4662-BBCE-62BBB20FC649}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{5D7F05E3-075A-43AF-8BC7-21E2F7F38845}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{617E26CE-E6E1-4C75-A68A-A001F2B98491}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{79FBDBEA-A722-4ABD-BEC0-B7D463F6BA0E}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{8128586C-DF69-4266-873F-CF4C6F705A7C}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F9CFCE-A7DC-4072-8B31-1DEA57004C86}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{EA4AD895-2A7F-430E-B973-DEE6C4E743A9}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{EBF4B60F-A863-426F-BE6F-5DFE83BC574F}
[-] Key Deleted : HKCU\Software\SweetLabs App Platform
[-] Key Deleted : HKLM\SOFTWARE\VisualDiscovery

***** [ Web browsers ] *****


*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [4679 bytes] ##########

Nainstalujte MBAM a udelejte vlastni sken vsech disku - http://forum.viry.cz/viewtopic.php?f=29&t=144868

• Upozorneni: tento sken zabere od 30 minut po nekolik hodin

scan jede porad uz skoro 5 hod myslim si ze to nema cenu

tak nakonec po 6-ti hodinách hotovo
nenašlo to nic

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 29. 12. 2015
Čas skenování: 15:39
Protokol: mbam.txt
Správce: Ano

Verze: 2.2.0.1024
Databáze malwaru: v2015.12.29.04
Databáze rootkitů: v2015.12.26.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows 8.1
CPU: x64
Souborový systém: NTFS
Uživatel: jiří

Typ skenu: Vlastní sken
Výsledek: Dokončeno
Prohledaných objektů: 568689
Uplynulý čas: 6 hod, 16 min, 16 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Zapnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 0
(Nenalezeny žádné škodlivé položky)

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

To je dobra zprava. Dejte logy FRST.txt a Addition.txt - http://forum.viry.cz/viewtopic.php?f=30&t=133101
Pozn. pri druhem a dalsim spusteni FRST je pro vytvoreni logu Addition.txt nutne tuto volbu explicitne zatrhnout pred zacatkem skenu.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:29-12-2015
Ran by jiří (administrator) on LENOVO-PC (30-12-2015 05:19:54)
Running from C:\Users\jiří\Desktop
Loaded Profiles: jiří (Available Profiles: jiří)
Platform: Windows 8.1 Connected (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(LENOVO INCORPORATED.) C:\Program Files\Lenovo\iMController\SystemAgentService.exe
(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Lenovo Updates\LUService.exe
(Lenovo) C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Pokki) C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\ServiceHostAppUpdater.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Realtek semiconductor) C:\Windows\RTFTrack.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Lenovo) C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
() C:\Program Files\Lenovo PhoneCompanion\adb.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft) C:\Program Files\WindowsApps\Microsoft.BingTranslator_1.14.0.0_x64__8wekyb3d8bbwe\Translator.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(forum.viry.cz) C:\Users\jiří\Desktop\FRSTLauncher.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-05] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [RtsFT] => C:\windows\RTFTrack.exe [6340312 2014-01-21] (Realtek semiconductor)
HKLM\...\Run: [PhoneCompanion] => C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe [836592 2014-09-19] (Lenovo)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [16094704 2014-09-19] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [10841584 2014-09-19] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-07] (CyberLink Corp.)
HKU\S-1-5-21-441833104-3594470175-1327339323-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)
HKU\S-1-5-21-441833104-3594470175-1327339323-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53282944 2015-06-29] (Skype Technologies S.A.)
HKU\S-1-5-21-441833104-3594470175-1327339323-1001\...\RunOnce: [Application Restart #3] => C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe [7875640 2015-10-30] (Pokki)
ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{413F6CCD-E1E7-4218-8C29-1EE1F4D039E4}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{85831336-3363-4F83-A474-983CC4731556}: [DhcpNameServer] 10.0.0.138

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-441833104-3594470175-1327339323-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.seznam.cz/
HKU\S-1-5-21-441833104-3594470175-1327339323-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-441833104-3594470175-1327339323-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-441833104-3594470175-1327339323-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
SearchScopes: HKU\S-1-5-21-441833104-3594470175-1327339323-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
SearchScopes: HKU\S-1-5-21-441833104-3594470175-1327339323-1001 -> {545329BB-704E-427B-A5CB-B8E101F31B7D} URL = hxxp://search.seznam.cz/?q={searchTerms}&sourceid=Searchmodule_1
SearchScopes: HKU\S-1-5-21-441833104-3594470175-1327339323-1001 -> {9B987CEA-E29F-4B44-A4A3-AE22EF73FB18} URL =
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-12-23] (Google Inc.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-12-23] (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-12-23] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-12-23] (Google Inc.)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab

FireFox:
========
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1219159.dll [2015-06-26] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)

Chrome:
=======
CHR Profile: C:\Users\jiří\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentace Google) - C:\Users\jiří\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-08]
CHR Extension: (Dokumenty Google) - C:\Users\jiří\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-08]
CHR Extension: (Disk Google) - C:\Users\jiří\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-30]
CHR Extension: (YouTube) - C:\Users\jiří\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-30]
CHR Extension: (Vyhledávání Google) - C:\Users\jiří\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-30]
CHR Extension: (Tabulky Google) - C:\Users\jiří\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-08]
CHR Extension: (Dokumenty Google offline) - C:\Users\jiří\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-30]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\jiří\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-11-30]
CHR Extension: (Gmail) - C:\Users\jiří\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-08]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [130008 2014-01-22] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [282096 2014-03-12] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-02] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-02] (Intel(R) Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-22] (LENOVO INCORPORATED.)
R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-09-19] (Lenovo(beijing) Limited)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272864 2015-12-10] (Lenovo)
R2 LUService; C:\Program Files (x86)\Lenovo\Lenovo Updates\LUService.exe [38896 2014-02-18] (Lenovo(beijing) Limited)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-01-18] ()
R2 PhoneCompanionPusher; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe [288240 2014-09-19] (Lenovo)
S3 PhoneCompanionVap; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe [305136 2014-09-19] (Lenovo)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe [67856 2014-09-19] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816176 2014-01-18] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [140600 2013-11-07] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1411384 2013-11-07] (Motorola Solutions, Inc.)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [498512 2015-11-26] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [157520 2015-11-30] (Symantec Corporation)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [149448 2014-01-22] (Intel Corporation)
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-10] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3443680 2014-06-01] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [9105624 2014-01-21] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-12-24] (Synaptics Incorporated)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-14] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-30 05:19 - 2015-12-30 05:20 - 00016985 _____ C:\Users\jiří\Desktop\FRST.txt
2015-12-30 05:19 - 2015-12-30 05:19 - 00000000 ____D C:\FRST
2015-12-30 05:17 - 2015-12-30 05:17 - 00112640 _____ (forum.viry.cz) C:\Users\jiří\Desktop\FRSTLauncher.exe
2015-12-30 05:14 - 2015-12-30 05:14 - 02370560 _____ (Farbar) C:\Users\jiří\Desktop\FRST64.exe
2015-12-29 21:59 - 2015-12-29 21:59 - 00001146 _____ C:\Users\jiří\Desktop\mbam.txt
2015-12-29 15:37 - 2015-12-29 15:39 - 00192216 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-12-29 15:37 - 2015-12-29 15:37 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-12-29 15:37 - 2015-12-29 15:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-12-29 15:37 - 2015-12-29 15:37 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-12-29 15:37 - 2015-12-29 15:37 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-12-29 15:37 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys
2015-12-29 15:37 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-12-29 15:37 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys
2015-12-29 15:35 - 2015-12-29 15:36 - 22908888 _____ (Malwarebytes ) C:\Users\jiří\Downloads\mbam-setup-2.2.0.1024.exe
2015-12-29 05:31 - 2015-12-29 05:38 - 00000000 ____D C:\AdwCleaner
2015-12-29 05:31 - 2015-12-29 05:31 - 01743360 _____ C:\Users\jiří\Desktop\adwcleaner_5.026.exe
2015-12-29 05:30 - 2015-12-29 05:31 - 01743360 _____ C:\Users\jiří\Downloads\adwcleaner_5.026.exe
2015-12-28 21:12 - 2015-12-28 21:12 - 02113152 _____ C:\Users\jiří\Downloads\PANDAFREEAV.exe
2015-12-28 21:03 - 2015-12-28 21:03 - 00162208 _____ C:\Users\jiří\Downloads\Antivirus_Free_Edition.exe
2015-12-28 20:13 - 2015-12-28 20:19 - 00000000 ____D C:\Program Files\trend micro
2015-12-28 20:13 - 2015-12-28 20:13 - 00000000 ____D C:\rsit
2015-12-28 19:54 - 2015-12-28 19:54 - 00000000 ____D C:\Users\jiří\AppData\Roaming\WinRAR
2015-12-28 19:54 - 2015-12-28 19:54 - 00000000 ____D C:\Users\jiří\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-12-28 19:54 - 2015-12-28 19:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-12-28 19:49 - 2015-12-28 19:54 - 00000000 ____D C:\Program Files\WinRAR
2015-12-28 19:49 - 2015-12-28 19:49 - 02154248 _____ C:\Users\jiří\Downloads\winrar-x64-530cz.exe
2015-12-28 19:45 - 2015-12-28 19:46 - 00000000 ___RD C:\Users\jiří\Desktop\Lenovo
2015-12-28 19:29 - 2015-12-28 19:29 - 01222144 _____ C:\Users\jiří\Downloads\RSITx64.exe
2015-12-28 19:25 - 2015-12-28 19:29 - 222223400 _____ C:\Users\jiří\Downloads\Norton 360 2014 2014 21.1.0 CZ.rar
2015-12-18 14:05 - 2014-04-16 00:35 - 00028352 _____ (Microsoft Corporation) C:\windows\SysWOW64\aspnet_counters.dll
2015-12-18 14:05 - 2014-04-16 00:34 - 00029888 _____ (Microsoft Corporation) C:\windows\system32\aspnet_counters.dll
2015-12-13 16:55 - 2015-12-25 19:11 - 00000000 ____D C:\windows\System32\Tasks\Remediation
2015-12-13 16:54 - 2015-12-13 16:54 - 00000000 ____D C:\Program Files\Common Files\AV
2015-12-10 19:25 - 2015-12-15 15:25 - 00000000 ____D C:\Users\jiří\AppData\Local\CrashDumps
2015-12-09 17:23 - 2015-11-11 17:00 - 12856832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-12-09 17:23 - 2015-11-08 22:15 - 00798208 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-12-09 17:23 - 2015-11-05 09:59 - 00145408 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rmcast.sys
2015-12-09 17:22 - 2015-11-11 17:21 - 25837568 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-12-09 17:22 - 2015-11-11 16:44 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-12-09 17:22 - 2015-11-11 16:44 - 00128000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2015-12-09 17:22 - 2015-11-11 16:41 - 20366848 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-12-09 17:22 - 2015-11-11 16:12 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-12-09 17:22 - 2015-11-10 01:13 - 00496640 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-12-09 17:22 - 2015-11-10 01:11 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-12-09 17:22 - 2015-11-10 01:08 - 02280448 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-12-09 17:22 - 2015-11-10 01:04 - 00476160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-12-09 17:22 - 2015-11-10 01:02 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-12-09 17:22 - 2015-11-10 00:46 - 04514816 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-12-09 17:22 - 2015-11-10 00:41 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-12-09 17:22 - 2015-11-10 00:37 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2015-12-09 17:22 - 2015-11-10 00:36 - 02050560 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-12-09 17:22 - 2015-11-10 00:36 - 00687104 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-12-09 17:22 - 2015-11-10 00:36 - 00325632 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-12-09 17:22 - 2015-11-10 00:25 - 01048576 _____ (Microsoft Corporation) C:\windows\SysWOW64\actxprxy.dll
2015-12-09 17:22 - 2015-11-10 00:17 - 02011136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-12-09 17:22 - 2015-11-10 00:14 - 01311744 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-12-09 17:22 - 2015-11-10 00:12 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-12-09 17:22 - 2015-11-08 23:15 - 02887168 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-12-09 17:22 - 2015-11-08 23:15 - 00571392 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-12-09 17:22 - 2015-11-08 23:04 - 05923840 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-12-09 17:22 - 2015-11-08 23:02 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-12-09 17:22 - 2015-11-08 23:01 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-12-09 17:22 - 2015-11-08 22:32 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-12-09 17:22 - 2015-11-08 22:32 - 00145408 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2015-12-09 17:22 - 2015-11-08 22:25 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-12-09 17:22 - 2015-11-08 22:18 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2015-12-09 17:22 - 2015-11-08 22:16 - 00372224 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-12-09 17:22 - 2015-11-08 22:15 - 00718336 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-12-09 17:22 - 2015-11-08 22:14 - 14456832 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-12-09 17:22 - 2015-11-08 22:13 - 02123264 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-12-09 17:22 - 2015-11-08 21:53 - 02880000 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
2015-12-09 17:22 - 2015-11-08 21:53 - 02487808 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-12-09 17:22 - 2015-11-08 21:41 - 01546752 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-12-09 17:22 - 2015-11-08 21:30 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-12-09 17:20 - 2015-11-22 07:59 - 07455064 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-12-09 17:20 - 2015-11-22 07:59 - 01735000 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-12-09 17:20 - 2015-11-22 07:59 - 01659568 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
2015-12-09 17:20 - 2015-11-22 07:59 - 01519592 _____ (Microsoft Corporation) C:\windows\system32\winload.exe
2015-12-09 17:20 - 2015-11-22 07:59 - 01487008 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
2015-12-09 17:20 - 2015-11-22 07:59 - 01355848 _____ (Microsoft Corporation) C:\windows\system32\winresume.exe
2015-12-09 17:20 - 2015-11-22 07:58 - 01499920 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-12-09 17:20 - 2015-11-21 19:32 - 00016896 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2015-12-09 17:20 - 2015-11-21 18:50 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2015-12-09 17:20 - 2015-11-21 17:59 - 01706496 _____ (Microsoft Corporation) C:\windows\system32\comsvcs.dll
2015-12-09 17:20 - 2015-11-21 17:49 - 01344000 _____ (Microsoft Corporation) C:\windows\SysWOW64\comsvcs.dll
2015-12-09 17:20 - 2015-11-21 17:47 - 00522240 _____ (Microsoft Corporation) C:\windows\system32\catsrvut.dll
2015-12-09 17:20 - 2015-11-21 17:40 - 00414208 _____ (Microsoft Corporation) C:\windows\SysWOW64\catsrvut.dll
2015-12-09 17:20 - 2015-11-09 01:41 - 01540728 _____ (Microsoft Corporation) C:\windows\system32\user32.dll
2015-12-09 17:20 - 2015-11-08 23:30 - 04176384 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-12-09 17:20 - 2015-11-08 22:23 - 01994752 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
2015-12-09 17:20 - 2015-11-08 22:13 - 01383936 _____ (Microsoft Corporation) C:\windows\system32\FntCache.dll
2015-12-09 17:20 - 2015-11-08 22:01 - 01753600 _____ (Microsoft Corporation) C:\windows\system32\GdiPlus.dll
2015-12-09 17:20 - 2015-11-08 21:52 - 01559552 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
2015-12-09 17:20 - 2015-11-08 21:48 - 01376256 _____ (Microsoft Corporation) C:\windows\SysWOW64\user32.dll
2015-12-09 17:20 - 2015-11-08 21:42 - 01490944 _____ (Microsoft Corporation) C:\windows\SysWOW64\GdiPlus.dll
2015-12-09 17:20 - 2015-10-10 18:20 - 00186880 _____ (Microsoft Corporation) C:\windows\system32\dpapisrv.dll
2015-12-09 17:20 - 2015-10-03 20:41 - 01385280 _____ (Microsoft Corporation) C:\windows\system32\msctf.dll
2015-12-09 17:20 - 2015-10-03 20:41 - 01124384 _____ (Microsoft Corporation) C:\windows\SysWOW64\msctf.dll
2015-12-09 17:19 - 2015-11-20 23:47 - 00136904 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-12-09 17:19 - 2015-11-20 19:18 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-12-09 17:19 - 2015-11-20 17:58 - 03706880 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-12-09 17:19 - 2015-11-20 17:47 - 00035840 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-12-09 17:19 - 2015-11-20 17:46 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-12-09 17:19 - 2015-11-20 17:44 - 00409088 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2015-12-09 17:19 - 2015-11-20 17:44 - 00095744 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-12-09 17:19 - 2015-11-20 17:43 - 00897024 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-12-09 17:19 - 2015-11-20 17:42 - 02243584 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-12-09 17:19 - 2015-11-20 17:30 - 00029696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2015-12-09 17:19 - 2015-11-20 17:29 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2015-12-09 17:19 - 2015-11-20 17:28 - 00081920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2015-12-09 17:19 - 2015-11-20 17:27 - 00726528 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2015-12-09 17:19 - 2015-10-28 16:49 - 02775552 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2015-12-09 17:19 - 2015-10-28 16:29 - 02462720 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2015-12-09 17:19 - 2015-10-11 07:34 - 00468824 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBHUB3.SYS
2015-12-09 17:19 - 2015-10-11 07:34 - 00462168 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2015-12-09 17:19 - 2015-10-11 07:34 - 00443224 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2015-12-09 17:19 - 2015-10-11 07:34 - 00092504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2015-12-09 17:19 - 2015-10-11 07:34 - 00027992 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2015-12-09 17:19 - 2015-10-10 19:41 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2015-12-09 17:19 - 2015-10-10 19:41 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2015-12-09 17:19 - 2015-10-10 19:40 - 00078848 _____ (Microsoft Corporation) C:\windows\system32\Drivers\winusb.sys
2015-12-09 17:19 - 2015-10-08 17:11 - 00060928 _____ (Microsoft Corporation) C:\windows\system32\PCPKsp.dll
2015-12-09 17:19 - 2015-10-08 16:50 - 00053248 _____ (Microsoft Corporation) C:\windows\SysWOW64\PCPKsp.dll
2015-12-09 17:19 - 2015-10-05 19:28 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\wininit.exe
2015-12-09 17:19 - 2015-10-05 19:25 - 00572928 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2015-11-30 18:49 - 2015-11-30 18:49 - 00000000 ____D C:\Users\Public\Downloads\Norton

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-30 05:19 - 2013-08-22 14:36 - 00000000 ____D C:\Windows
2015-12-30 04:17 - 2015-04-01 12:27 - 00003970 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{F90DC76D-A596-4B1A-B8E9-DC01259324FD}
2015-12-29 16:53 - 2013-08-22 16:20 - 00000000 ____D C:\windows\CbsTemp
2015-12-29 16:52 - 2015-04-01 12:30 - 00003598 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-441833104-3594470175-1327339323-1001
2015-12-29 16:52 - 2013-08-22 14:36 - 00000000 ____D C:\windows\Inf
2015-12-29 15:38 - 2015-06-21 15:29 - 00001279 _____ C:\Users\jiří\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wi-FiHotspotChgToast.lnk
2015-12-29 15:38 - 2014-09-19 17:42 - 00000000 ____D C:\ProgramData\LU
2015-12-29 15:34 - 2015-04-04 08:54 - 00000000 ____D C:\Users\jiří\AppData\Roaming\Skype
2015-12-29 05:44 - 2015-04-11 20:05 - 00000000 ___DO C:\Users\jiří\OneDrive
2015-12-29 05:42 - 2015-04-08 15:05 - 00000976 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-29 05:40 - 2015-11-26 18:34 - 00000000 ____D C:\ProgramData\Norton
2015-12-29 05:40 - 2013-08-22 15:45 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-12-29 05:39 - 2013-08-22 14:25 - 00786432 ___SH C:\windows\system32\config\BBI
2015-12-29 05:38 - 2014-09-19 17:32 - 00002560 _____ C:\windows\system32\VfService.trf
2015-12-29 05:30 - 2015-04-01 12:23 - 00000000 ____D C:\Users\jiří\AppData\Local\SweetLabs App Platform
2015-12-28 20:14 - 2013-08-22 16:36 - 00000000 ___HD C:\windows\ELAMBKUP
2015-12-28 20:14 - 2013-08-22 14:25 - 00262144 ___SH C:\windows\system32\config\ELAM
2015-12-28 19:35 - 2015-04-01 12:34 - 00000000 ____D C:\Users\jiří\AppData\Roaming\LSC
2015-12-28 19:35 - 2014-09-19 17:18 - 00000000 ____D C:\Program Files\Lenovo
2015-12-28 19:35 - 2014-09-19 17:17 - 00000000 ____D C:\windows\System32\Tasks\Lenovo
2015-12-28 19:33 - 2014-09-19 17:17 - 00000000 ____D C:\windows\Downloaded Installations
2015-12-28 19:27 - 2015-11-26 18:34 - 00000000 ____D C:\ProgramData\NortonInstaller
2015-12-28 16:26 - 2013-08-22 16:36 - 00000000 ____D C:\windows\rescache
2015-12-26 16:03 - 2015-04-01 12:23 - 00000000 ____D C:\Users\jiří
2015-12-24 21:22 - 2014-09-19 17:10 - 00739924 _____ C:\windows\system32\perfh005.dat
2015-12-24 21:22 - 2014-09-19 17:10 - 00151610 _____ C:\windows\system32\perfc005.dat
2015-12-24 21:22 - 2014-03-18 10:53 - 01745984 _____ C:\windows\system32\PerfStringBackup.INI
2015-12-24 19:15 - 2015-07-12 18:17 - 00000000 ____D C:\Users\jiří\Desktop\Verunka
2015-12-24 17:37 - 2013-08-22 16:36 - 00000000 ____D C:\windows\AppReadiness
2015-12-24 06:55 - 2015-04-10 13:14 - 00000000 ___SD C:\windows\SysWOW64\GWX
2015-12-24 06:55 - 2015-04-10 13:14 - 00000000 ___SD C:\windows\system32\GWX
2015-12-22 20:03 - 2013-08-22 16:36 - 00000000 ___HD C:\Program Files\WindowsApps
2015-12-17 09:27 - 2015-04-08 15:06 - 00002214 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-13 16:49 - 2013-08-22 15:44 - 00346656 _____ C:\windows\system32\FNTCACHE.DAT
2015-12-12 16:48 - 2015-04-01 12:24 - 00000000 ____D C:\Users\jiří\AppData\Local\Packages
2015-12-10 12:39 - 2015-04-03 16:38 - 00000000 ____D C:\windows\system32\MRT
2015-12-10 12:34 - 2015-04-03 16:38 - 140158008 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-12-09 04:39 - 2015-07-10 05:58 - 00301728 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2015-12-08 17:17 - 2015-11-20 17:05 - 00000000 ____D C:\Users\jiří\Desktop\Taťka
2015-12-04 15:20 - 2015-04-08 15:05 - 00003952 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-04 15:20 - 2015-04-08 15:05 - 00003716 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-04 15:20 - 2015-04-08 15:05 - 00000980 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-01 18:19 - 2015-05-19 15:59 - 00826872 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-12-01 18:19 - 2015-05-19 15:59 - 00176632 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-11-30 19:02 - 2014-09-19 17:20 - 00000000 ____D C:\ProgramData\McAfee

==================== Files in the root of some directories =======

2014-09-19 16:39 - 2014-09-19 16:39 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\jiří\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================


==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\ji��\Desktop" je 17233 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000000
"Generalize_DisableSR"=dword:00000000


==================== End Of Log ==============================

Velikost plochy by nemela presahovat 200 MB. Zpomaluje se pak start i samotny chod celeho PC. Doporucuji hlavne velke soubory a slozky premistit napr. do Dokumentu a na plochu umistit pouze zastupce.

• Do Poznamkoveho bloku (Start -> spustit -> notepad) zkopirujte obsah bileho pole
• ulozte na plochu jako fixlist (Typ souboru: Textovy dokument)
• znovu spustte FRST a kliknete na Fix
• po restartu bude na plose ulozen fixlog, jehoz obsah vlozte do pristi odpovedi

  Kód: Vybrat vše

  Start
  CreateRestorePoint:
  CloseProcesses:
  HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-07] (CyberLink Corp.)
  SearchScopes: HKU\S-1-5-21-441833104-3594470175-1327339323-1001 -> {9B987CEA-E29F-4B44-A4A3-AE22EF73FB18} URL = 
  2015-12-29 21:59 - 2015-12-29 21:59 - 00001146 _____ C:\Users\jiří\Desktop\mbam.txt
  2015-12-29 05:31 - 2015-12-29 05:38 - 00000000 ____D C:\AdwCleaner
  2015-12-29 05:31 - 2015-12-29 05:31 - 01743360 _____ C:\Users\jiří\Desktop\adwcleaner_5.026.exe
  2015-12-29 05:30 - 2015-12-29 05:31 - 01743360 _____ C:\Users\jiří\Downloads\adwcleaner_5.026.exe
  2015-12-28 20:13 - 2015-12-28 20:19 - 00000000 ____D C:\Program Files\trend micro
  2015-12-28 20:13 - 2015-12-28 20:13 - 00000000 ____D C:\rsit
  Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  Task: {A89EBE83-8605-42DE-B280-6DAB8DBBCC0C} - System32\Tasks\SweetLabs App Platform => C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\ServiceHostAppUpdater.exe [2015-10-30] (Pokki)
  Hosts:
  EmptyTemp:
  End

Fix result of Farbar Recovery Scan Tool (x64) Version:29-12-2015
Ran by jiří (2015-12-30 18:02:49) Run:1
Running from C:\Users\jiří\Desktop
Loaded Profiles: jiří (Available Profiles: jiří)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-07] (CyberLink Corp.)
SearchScopes: HKU\S-1-5-21-441833104-3594470175-1327339323-1001 -> {9B987CEA-E29F-4B44-A4A3-AE22EF73FB18} URL =
2015-12-29 21:59 - 2015-12-29 21:59 - 00001146 _____ C:\Users\jiří\Desktop\mbam.txt
2015-12-29 05:31 - 2015-12-29 05:38 - 00000000 ____D C:\AdwCleaner
2015-12-29 05:31 - 2015-12-29 05:31 - 01743360 _____ C:\Users\jiří\Desktop\adwcleaner_5.026.exe
2015-12-29 05:30 - 2015-12-29 05:31 - 01743360 _____ C:\Users\jiří\Downloads\adwcleaner_5.026.exe
2015-12-28 20:13 - 2015-12-28 20:19 - 00000000 ____D C:\Program Files\trend micro
2015-12-28 20:13 - 2015-12-28 20:13 - 00000000 ____D C:\rsit
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {A89EBE83-8605-42DE-B280-6DAB8DBBCC0C} - System32\Tasks\SweetLabs App Platform => C:\Users\jiří\AppData\Local\SweetLabs App Platform\Engine\ServiceHostAppUpdater.exe [2015-10-30] (Pokki)
Hosts:
EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\UpdateP2GShortCut => value removed successfully
"HKU\S-1-5-21-441833104-3594470175-1327339323-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9B987CEA-E29F-4B44-A4A3-AE22EF73FB18}" => key removed successfully
HKCR\CLSID\{9B987CEA-E29F-4B44-A4A3-AE22EF73FB18} => key not found.
C:\Users\jiří\Desktop\mbam.txt => moved successfully
C:\AdwCleaner => moved successfully
C:\Users\jiří\Desktop\adwcleaner_5.026.exe => moved successfully
C:\Users\jiří\Downloads\adwcleaner_5.026.exe => moved successfully
C:\Program Files\trend micro => moved successfully
C:\rsit => moved successfully
C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{A89EBE83-8605-42DE-B280-6DAB8DBBCC0C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A89EBE83-8605-42DE-B280-6DAB8DBBCC0C}" => key removed successfully
C:\windows\System32\Tasks\SweetLabs App Platform => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SweetLabs App Platform" => key removed successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
EmptyTemp: => 559.9 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 18:03:44 ====

Zkontrolujte, jake problemy na PC pozorujete nyni.

Vypadá to že je problém vyřešen, ještě teda asi nainstaluju pandu a hotovo.

Pokud nainstalujete Pandu, trvale vypnete Windows Defender - http://windows.microsoft.com/cs-cz/wind ... =windows-7

• Stahnete a spustte DelFix - https://toolslib.net/downloads/viewdownload/2-delfix/
• Oznacte jen moznost "Remove disinfection tools"
• kliknete na Run

A pokud nejsou dotazy ci jine problemy, je to ode mne vse.

Moc děkuji za pomoc a ochotu

Nemate zac, rad jsem pomohl


Mejte se krasne a treba zase nekdy