preventivka - pomalý NB

[mysa]

Dobrý den,

poprosil bych o preventivní kontrolu PC.

děkuji

FRST log:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:09-01-2015
Ran by Michal (administrator) on MICHAL-NB (10-01-2016 13:09:52)
Running from C:\Users\Michal\Desktop
Loaded Profiles: Michal (Available Profiles: Michal)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Autodesk Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
() C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(CANON INC.) C:\Windows\System32\spool\drivers\x64\3\CNAP2LAK.EXE
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(CANON INC.) C:\Windows\System32\spool\drivers\x64\3\CNAP2RPK.EXE
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(CANON INC.) C:\Windows\System32\spool\drivers\x64\3\CNAC8SWK.EXE
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Update\GoogleUpdate.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD64.EXE
(Adobe Systems Incorporated) C:\Program Files\Adobe\Adobe Bridge CC (64 Bit)\Bridge.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Adobe Bridge CC (64 Bit)\SwitchBoard\SwitchBoard.exe
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [CNAP2 Launcher] => C:\Windows\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE [406944 2007-09-05] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-05-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6111312 2015-11-06] (AVAST Software)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe [170624 2009-08-19] (ASUS)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe [6859392 2009-08-17] (ASUS)
HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499896 2014-05-08] (Adobe Systems Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22790776 2015-11-04] (Google)
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Run: [Google Update] => C:\Users\Michal\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-30] (Google Inc.)
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Policies\Explorer: []
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {382b684f-d7a2-11e4-837b-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {a6b719d8-1817-11e5-bdda-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {e25eab06-633c-11e4-b3f8-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-18\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1310088 2015-01-27] (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-08-13] (AVAST Software)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2015-02-06] (Autodesk, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 213.155.229.197
Tcpip\..\Interfaces\{14FA1194-2AB3-4494-94AD-63E901514501}: [DhcpNameServer] 213.155.229.197
Tcpip\..\Interfaces\{1DD31D12-5A28-4AF1-B90B-494E0346F3CD}: [NameServer] 93.153.117.33 93.153.117.1
Tcpip\..\Interfaces\{26B06885-4735-449E-9ED1-8F08E489B112}: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{5CC4D58C-ED56-4B4C-B087-8C0FDDF6C721}: [NameServer] 93.153.117.1 93.153.117.33

Internet Explorer:
==================
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2014-01-23] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-08-13] (AVAST Software)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-30] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-08-13] (AVAST Software)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-30] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1348850115-4210626098-1049065160-1000 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
DPF: HKLM-x32 {021AFC0F-30F4-474D-9903-CE42D9539B17} hxxp://192.168.1.222/dvr_ocx.cab
DPF: HKLM-x32 {D9305048-DD6B-4EDF-8706-096EBE24E1D7} hxxp://192.168.1.222/IPCWeb.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-01-23] (Microsoft Corporation)

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-03-09] (Adobe Systems)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-30] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-30] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2013-11-15] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-03-09] (Adobe Systems)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin HKU\S-1-5-21-1348850115-4210626098-1049065160-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Michal\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin HKU\S-1-5-21-1348850115-4210626098-1049065160-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Michal\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2013-11-15] (Microsoft Corporation)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-15]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2015-11-27] [not signed]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com
CHR Profile: C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentace Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-04]
CHR Extension: (Dokumenty Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]
CHR Extension: (Disk Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (YouTube) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-01]
CHR Extension: (Vyhledávání Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-07]
CHR Extension: (Adobe Acrobat) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2015-11-27]
CHR Extension: (Tabulky Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-04]
CHR Extension: (Dokumenty Google offline) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-20]
CHR Extension: (Avast Online Security) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-11-07]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-03-05]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-28]
CHR Extension: (Gmail) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-01]
CHR HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-05-08]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-23]
StartMenuInternet: Google Chrome.54WLATO4JJINMTJ4MDKQQGL6JA - C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [599944 2014-12-05] (Autodesk Inc.)
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [File not signed]
S2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [18656 2011-02-02] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-08-13] (AVAST Software)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 MbnExt; C:\Program Files (x86)\T-Mobile\T-Mobile Internet Manager\MbnExt.dll [419096 2015-08-25] (Gemfor s.r.o.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-10-21] (Microsoft Corporation)
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [672024 2015-02-26] (Wacom Technology, Corp.)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ASMMAP64; C:\Program Files\ATKGFNEX\ASMMAP64.sys [14904 2007-07-24] ()
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-08-13] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90968 2015-08-13] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-08-13] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-08-13] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1059656 2015-11-06] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [449992 2015-11-06] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [150672 2015-08-13] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-08-13] (AVAST Software)
S3 BFN7x64; C:\Windows\system32\drivers\Xeno7x64.sys [157288 2012-02-22] (Bigfoot Networks, Inc.)
R3 BthMtpEnum; C:\Windows\System32\DRIVERS\BthMtpEnum.sys [64512 2009-07-14] (Microsoft Corporation)
S3 cbaf; C:\Windows\System32\Drivers\cbaf.sys [15872 2008-01-09] (Intel Corp.)
S3 dfuuwb; C:\Windows\System32\Drivers\DfuUWB.sys [503296 2008-09-11] (Intel Corp.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2015-03-01] (DT Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 EtronSTOR; C:\Windows\System32\Drivers\EtronSTOR.sys [32512 2012-08-07] (Etron Technology Inc)
S3 FLxHCIh; C:\Windows\system32\drivers\FLxHCIh.sys [77040 2012-11-02] (Fresco Logic)
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [246272 2013-06-29] (Huawei Technologies Co., Ltd.)
S3 HWA; C:\Windows\System32\Drivers\HWA.sys [61440 2008-09-29] (Intel Corp.)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [110744 2012-07-19] (Qualcomm Atheros Co., Ltd.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-06-03] (Malwarebytes Corporation)
S3 rusb3hub; C:\Windows\system32\drivers\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
S3 rusb3xhc; C:\Windows\system32\drivers\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
S3 uagp35; C:\Windows\system32\drivers\sisagpx.sys [67104 2009-08-01] (Silicon Integrated Systems Corporation)
S3 uwbusb; C:\Windows\System32\Drivers\usbuwbmini.sys [13312 2008-09-15] (Intel Corp.)
S3 VUSB3HUB; C:\Windows\system32\drivers\ViaHub3.sys [210944 2012-05-30] (VIA Technologies, Inc.)
S3 xhcdrv; C:\Windows\system32\drivers\xhcdrv.sys [261120 2012-05-30] (VIA Technologies, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-10 13:09 - 2016-01-10 13:11 - 00021522 _____ C:\Users\Michal\Desktop\FRST.txt
2016-01-10 13:09 - 2016-01-10 13:09 - 00000000 ____D C:\FRST
2016-01-10 13:08 - 2016-01-10 13:08 - 02370560 _____ (Farbar) C:\Users\Michal\Desktop\FRST64.exe
2016-01-08 08:54 - 2016-01-08 08:54 - 50610152 _____ (LPsoft ) C:\Users\Michal\Downloads\PROFIT_201505_setup.exe
2015-12-16 07:54 - 2015-12-16 07:54 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-12-16 07:54 - 2015-12-16 07:54 - 00000000 ____D C:\Users\Michal\Tracing
2015-12-16 07:54 - 2015-12-16 07:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-10 13:10 - 2009-07-14 05:45 - 00031888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-01-10 13:10 - 2009-07-14 05:45 - 00031888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-01-10 13:09 - 2009-07-14 04:20 - 00000000 ____D C:\Windows
2016-01-10 13:05 - 2015-05-19 13:31 - 00000952 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-10 11:17 - 2015-05-18 06:53 - 00000914 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1348850115-4210626098-1049065160-1000Core.job
2016-01-09 17:39 - 2011-04-12 09:34 - 00670584 _____ C:\Windows\system32\perfh005.dat
2016-01-09 17:39 - 2011-04-12 09:34 - 00142164 _____ C:\Windows\system32\perfc005.dat
2016-01-09 17:39 - 2009-07-14 06:13 - 01583226 _____ C:\Windows\system32\PerfStringBackup.INI
2016-01-09 17:39 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2016-01-09 15:36 - 2015-05-19 13:31 - 00000948 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-08 09:36 - 2014-11-06 15:39 - 00000000 ___RD C:\Users\Michal\Disk Google
2016-01-08 09:33 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-01-08 09:22 - 2015-01-08 11:17 - 00000881 _____ C:\ProgramData\Microsoft\Windows\Start Menu\PROFIT.lnk
2016-01-08 09:22 - 2015-01-08 11:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LPsoft PROFIT
2016-01-08 08:34 - 2014-11-02 14:03 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-01-04 09:21 - 2015-03-25 09:38 - 00000000 ____D C:\Users\Michal\AppData\Local\Adobe
2015-12-22 10:56 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2015-12-22 10:07 - 2009-07-14 05:45 - 05196048 _____ C:\Windows\system32\FNTCACHE.DAT
2015-12-22 10:05 - 2014-11-19 13:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-12-22 10:03 - 2015-04-08 09:41 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-12-22 10:03 - 2015-04-08 09:41 - 00000000 ___SD C:\Windows\system32\GWX
2015-12-17 10:11 - 2015-01-14 10:25 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Skype
2015-12-16 13:06 - 2015-09-07 16:59 - 00001480 _____ C:\Users\Michal\AppData\Local\Adobe Uložit pro web 13.0 Prefs
2015-12-16 07:54 - 2015-01-14 10:25 - 00000000 ____D C:\Users\Michal\AppData\Local\Skype
2015-12-16 07:54 - 2015-01-14 10:25 - 00000000 ____D C:\ProgramData\Skype
2015-12-16 07:54 - 2014-11-02 11:39 - 00000000 ____D C:\Users\Michal
2015-12-15 11:59 - 2014-11-05 06:59 - 00000000 ____D C:\Users\Michal\AppData\Local\ElevatedDiagnostics
2015-12-15 08:42 - 2014-11-13 09:21 - 00000000 ____D C:\Users\Michal\AppData\Local\CrashDumps

==================== Files in the root of some directories =======

2015-03-25 11:23 - 2015-12-02 13:51 - 0000034 _____ () C:\Users\Michal\AppData\Roaming\AdobeWLCMCache.dat
2015-10-15 09:47 - 2015-10-15 10:21 - 0000268 ___RH () C:\Users\Michal\AppData\Roaming\Animals
2015-10-26 11:22 - 2015-10-26 12:02 - 0000442 _____ () C:\Users\Michal\AppData\Roaming\MICHAL-NB.MTBF.txt
2015-09-07 16:59 - 2015-12-16 13:06 - 0001480 _____ () C:\Users\Michal\AppData\Local\Adobe Uložit pro web 13.0 Prefs
2015-10-26 12:15 - 2015-10-26 12:15 - 0003584 _____ () C:\Users\Michal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-04-05 11:19 - 2015-04-05 11:19 - 0007597 _____ () C:\Users\Michal\AppData\Local\Resmon.ResmonCfg
2015-03-30 10:51 - 2015-03-30 10:51 - 0000008 __RSH () C:\ProgramData\1BABCD0E97.sys
2015-10-15 10:21 - 2015-10-15 10:21 - 0000000 _____ () C:\ProgramData\Abstract
2015-10-15 10:21 - 2015-10-15 10:21 - 0000000 _____ () C:\ProgramData\Analog Sync
2015-10-15 09:47 - 2015-10-15 10:21 - 0000268 ___RH () C:\ProgramData\Applications
2015-03-30 10:51 - 2015-12-06 10:51 - 0000952 ___SH () C:\ProgramData\KGyGaAvL.sys
2014-12-16 12:19 - 2014-12-16 12:19 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2015-06-05 12:13 - 2015-06-05 12:13 - 0000133 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
2015-11-27 19:25 - 2015-11-27 19:25 - 0000089 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2015-10-15 09:31 - 2015-11-06 17:52 - 0000020 ____H () C:\ProgramData\PKP_DLdy.DAT

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-01-09 15:30

==================== End of FRST.txt ============================

[Rudy]

Zdravím!
Spusťte tuto utilitu:

Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

[mysa]

# AdwCleaner v5.029 - Logfile created 12/01/2016 at 07:05:08
# Updated 11/01/2016 by Xplode
# Database : 2016-01-11.4 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x64)
# Username : Michal - MICHAL-NB
# Running from : C:\Users\Michal\Desktop\adwcleaner_5.029.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLL ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [591 bytes] ##########

[Rudy]

Toto je OK. Otevřte poznámkový blok a zkopírujte do něj:

Start
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Policies\Explorer: []
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {382b684f-d7a2-11e4-837b-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {a6b719d8-1817-11e5-bdda-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {e25eab06-633c-11e4-b3f8-e0cb4e9eb3ae} - F:\Autorun.exe
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1348850115-4210626098-1049065160-1000Core.job
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Users\Michal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
C:\ProgramData\1BABCD0E97.sys
C:\ProgramData\KGyGaAvL.sys
C:\ProgramData\PKP_DLdy.DAT
C:\Users\Michal\AppData\Local\Temp
AlternateDataStreams: C:\ProgramData\TEMP:FD268286

ResetHosts:
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

[mysa]

Fix result of Farbar Recovery Scan Tool (x64) Version:09-01-2015
Ran by Michal (2016-01-13 08:28:40) Run:1
Running from C:\Users\Michal\Desktop
Loaded Profiles: Michal (Available Profiles: Michal)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Policies\Explorer: []
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {382b684f-d7a2-11e4-837b-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {a6b719d8-1817-11e5-bdda-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {e25eab06-633c-11e4-b3f8-e0cb4e9eb3ae} - F:\Autorun.exe
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1348850115-4210626098-1049065160-1000Core.job
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Users\Michal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
C:\ProgramData\1BABCD0E97.sys
C:\ProgramData\KGyGaAvL.sys
C:\ProgramData\PKP_DLdy.DAT
C:\Users\Michal\AppData\Local\Temp
AlternateDataStreams: C:\ProgramData\TEMP:FD268286

ResetHosts:
End
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => value removed successfully
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\ => value removed successfully
"HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{382b684f-d7a2-11e4-837b-e0cb4e9eb3ae}" => key removed successfully
HKCR\CLSID\{382b684f-d7a2-11e4-837b-e0cb4e9eb3ae} => key not found.
"HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6b719d8-1817-11e5-bdda-e0cb4e9eb3ae}" => key removed successfully
HKCR\CLSID\{a6b719d8-1817-11e5-bdda-e0cb4e9eb3ae} => key not found.
"HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e25eab06-633c-11e4-b3f8-e0cb4e9eb3ae}" => key removed successfully
HKCR\CLSID\{e25eab06-633c-11e4-b3f8-e0cb4e9eb3ae} => key not found.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1348850115-4210626098-1049065160-1000Core.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\Users\Michal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
C:\ProgramData\1BABCD0E97.sys => moved successfully
C:\ProgramData\KGyGaAvL.sys => moved successfully
C:\ProgramData\PKP_DLdy.DAT => moved successfully

"C:\Users\Michal\AppData\Local\Temp" folder move:

Could not move "C:\Users\Michal\AppData\Local\Temp" => Scheduled to move on reboot.

C:\ProgramData\TEMP => ":FD268286" ADS removed successfully.
ResetHosts: => Error: No automatic fix found for this entry.

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2016-01-13 08:34:05)

C:\Users\Michal\AppData\Local\Temp => moved successfully

==== End of Fixlog 08:34:05 ====

[Rudy]

Smazáno. Nastala nějaká změna?

[mysa]

já zatím změnu nepozoruji, PC je pořád trochu zpomalené

[Rudy]

Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

[mysa]

scan proveden. Nemůže být spíše problém ve spuštěných procesech než malware, ikdyž to by asi mohlo souviset. test MAM nic nenašel

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 15.1.2016
Čas skenování: 9:14
Protokol: mam.txt
Správce: Ano

Verze: 2.2.0.1024
Databáze malwaru: v2016.01.15.03
Databáze rootkitů: v2016.01.09.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: Michal

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 358876
Uplynulý čas: 19 min, 48 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 0
(Nenalezeny žádné škodlivé položky)

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

[Rudy]

Po virové stránce máte čisto. Co jste instaloval těsně před tím, než se problém objevil?

[mysa]

právě, že nic zásadního, pouze klasický provoz WIN7, internet, photoshop, cad. žádné hry.

[Rudy]

Zkuste tedy obnovu systému k datu, kdy korektně fungoval.

[mysa]

to už možná raději čistý reinstal, což jsem teď nechtěl. děkuji

[Rudy]

Divím se. Při obnově systému se vám odregistrují (znefunkční) pouze instalace provedené mez datem bodu obnovy a dneškem. Je to běžný a rychlý způsob opravy. Sice nezabere vždy, ale není od věci to zkusit.

[mysa]

příležitostně tedy vyzkouším.

jinak velice děkuji za scan na viry a ostatní

(můžete uzavřít)