VIRY.CZ

Dobrý den,

poprosil bych o preventivní kontrolu PC.

děkuji

FRST log:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:09-01-2015
Ran by Michal (administrator) on MICHAL-NB (10-01-2016 13:09:52)
Running from C:\Users\Michal\Desktop
Loaded Profiles: Michal (Available Profiles: Michal)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Autodesk Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
() C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(CANON INC.) C:\Windows\System32\spool\drivers\x64\3\CNAP2LAK.EXE
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(CANON INC.) C:\Windows\System32\spool\drivers\x64\3\CNAP2RPK.EXE
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(CANON INC.) C:\Windows\System32\spool\drivers\x64\3\CNAC8SWK.EXE
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Update\GoogleUpdate.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD64.EXE
(Adobe Systems Incorporated) C:\Program Files\Adobe\Adobe Bridge CC (64 Bit)\Bridge.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Adobe Bridge CC (64 Bit)\SwitchBoard\SwitchBoard.exe
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [CNAP2 Launcher] => C:\Windows\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE [406944 2007-09-05] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-05-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6111312 2015-11-06] (AVAST Software)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe [170624 2009-08-19] (ASUS)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe [6859392 2009-08-17] (ASUS)
HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499896 2014-05-08] (Adobe Systems Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22790776 2015-11-04] (Google)
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Run: [Google Update] => C:\Users\Michal\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-30] (Google Inc.)
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Policies\Explorer: []
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {382b684f-d7a2-11e4-837b-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {a6b719d8-1817-11e5-bdda-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {e25eab06-633c-11e4-b3f8-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-18\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1310088 2015-01-27] (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-08-13] (AVAST Software)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2015-02-06] (Autodesk, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 213.155.229.197
Tcpip\..\Interfaces\{14FA1194-2AB3-4494-94AD-63E901514501}: [DhcpNameServer] 213.155.229.197
Tcpip\..\Interfaces\{1DD31D12-5A28-4AF1-B90B-494E0346F3CD}: [NameServer] 93.153.117.33 93.153.117.1
Tcpip\..\Interfaces\{26B06885-4735-449E-9ED1-8F08E489B112}: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{5CC4D58C-ED56-4B4C-B087-8C0FDDF6C721}: [NameServer] 93.153.117.1 93.153.117.33

Internet Explorer:
==================
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2014-01-23] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-08-13] (AVAST Software)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-30] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-08-13] (AVAST Software)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-30] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1348850115-4210626098-1049065160-1000 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
DPF: HKLM-x32 {021AFC0F-30F4-474D-9903-CE42D9539B17} hxxp://192.168.1.222/dvr_ocx.cab
DPF: HKLM-x32 {D9305048-DD6B-4EDF-8706-096EBE24E1D7} hxxp://192.168.1.222/IPCWeb.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-01-23] (Microsoft Corporation)

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-03-09] (Adobe Systems)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-30] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-30] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2013-11-15] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-03-09] (Adobe Systems)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin HKU\S-1-5-21-1348850115-4210626098-1049065160-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Michal\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin HKU\S-1-5-21-1348850115-4210626098-1049065160-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Michal\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2013-11-15] (Microsoft Corporation)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-15]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2015-11-27] [not signed]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com
CHR Profile: C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentace Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-04]
CHR Extension: (Dokumenty Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]
CHR Extension: (Disk Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (YouTube) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-01]
CHR Extension: (Vyhledávání Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-07]
CHR Extension: (Adobe Acrobat) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2015-11-27]
CHR Extension: (Tabulky Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-04]
CHR Extension: (Dokumenty Google offline) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-20]
CHR Extension: (Avast Online Security) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-11-07]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-03-05]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-28]
CHR Extension: (Gmail) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-01]
CHR HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-05-08]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-23]
StartMenuInternet: Google Chrome.54WLATO4JJINMTJ4MDKQQGL6JA - C:\Users\Michal\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [599944 2014-12-05] (Autodesk Inc.)
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [File not signed]
S2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [18656 2011-02-02] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-08-13] (AVAST Software)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 MbnExt; C:\Program Files (x86)\T-Mobile\T-Mobile Internet Manager\MbnExt.dll [419096 2015-08-25] (Gemfor s.r.o.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-10-21] (Microsoft Corporation)
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [672024 2015-02-26] (Wacom Technology, Corp.)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ASMMAP64; C:\Program Files\ATKGFNEX\ASMMAP64.sys [14904 2007-07-24] ()
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-08-13] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90968 2015-08-13] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-08-13] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-08-13] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1059656 2015-11-06] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [449992 2015-11-06] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [150672 2015-08-13] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-08-13] (AVAST Software)
S3 BFN7x64; C:\Windows\system32\drivers\Xeno7x64.sys [157288 2012-02-22] (Bigfoot Networks, Inc.)
R3 BthMtpEnum; C:\Windows\System32\DRIVERS\BthMtpEnum.sys [64512 2009-07-14] (Microsoft Corporation)
S3 cbaf; C:\Windows\System32\Drivers\cbaf.sys [15872 2008-01-09] (Intel Corp.)
S3 dfuuwb; C:\Windows\System32\Drivers\DfuUWB.sys [503296 2008-09-11] (Intel Corp.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2015-03-01] (DT Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 EtronSTOR; C:\Windows\System32\Drivers\EtronSTOR.sys [32512 2012-08-07] (Etron Technology Inc)
S3 FLxHCIh; C:\Windows\system32\drivers\FLxHCIh.sys [77040 2012-11-02] (Fresco Logic)
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [246272 2013-06-29] (Huawei Technologies Co., Ltd.)
S3 HWA; C:\Windows\System32\Drivers\HWA.sys [61440 2008-09-29] (Intel Corp.)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [110744 2012-07-19] (Qualcomm Atheros Co., Ltd.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-06-03] (Malwarebytes Corporation)
S3 rusb3hub; C:\Windows\system32\drivers\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
S3 rusb3xhc; C:\Windows\system32\drivers\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
S3 uagp35; C:\Windows\system32\drivers\sisagpx.sys [67104 2009-08-01] (Silicon Integrated Systems Corporation)
S3 uwbusb; C:\Windows\System32\Drivers\usbuwbmini.sys [13312 2008-09-15] (Intel Corp.)
S3 VUSB3HUB; C:\Windows\system32\drivers\ViaHub3.sys [210944 2012-05-30] (VIA Technologies, Inc.)
S3 xhcdrv; C:\Windows\system32\drivers\xhcdrv.sys [261120 2012-05-30] (VIA Technologies, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-10 13:09 - 2016-01-10 13:11 - 00021522 _____ C:\Users\Michal\Desktop\FRST.txt
2016-01-10 13:09 - 2016-01-10 13:09 - 00000000 ____D C:\FRST
2016-01-10 13:08 - 2016-01-10 13:08 - 02370560 _____ (Farbar) C:\Users\Michal\Desktop\FRST64.exe
2016-01-08 08:54 - 2016-01-08 08:54 - 50610152 _____ (LPsoft ) C:\Users\Michal\Downloads\PROFIT_201505_setup.exe
2015-12-16 07:54 - 2015-12-16 07:54 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-12-16 07:54 - 2015-12-16 07:54 - 00000000 ____D C:\Users\Michal\Tracing
2015-12-16 07:54 - 2015-12-16 07:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-10 13:10 - 2009-07-14 05:45 - 00031888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-01-10 13:10 - 2009-07-14 05:45 - 00031888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-01-10 13:09 - 2009-07-14 04:20 - 00000000 ____D C:\Windows
2016-01-10 13:05 - 2015-05-19 13:31 - 00000952 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-10 11:17 - 2015-05-18 06:53 - 00000914 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1348850115-4210626098-1049065160-1000Core.job
2016-01-09 17:39 - 2011-04-12 09:34 - 00670584 _____ C:\Windows\system32\perfh005.dat
2016-01-09 17:39 - 2011-04-12 09:34 - 00142164 _____ C:\Windows\system32\perfc005.dat
2016-01-09 17:39 - 2009-07-14 06:13 - 01583226 _____ C:\Windows\system32\PerfStringBackup.INI
2016-01-09 17:39 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2016-01-09 15:36 - 2015-05-19 13:31 - 00000948 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-08 09:36 - 2014-11-06 15:39 - 00000000 ___RD C:\Users\Michal\Disk Google
2016-01-08 09:33 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-01-08 09:22 - 2015-01-08 11:17 - 00000881 _____ C:\ProgramData\Microsoft\Windows\Start Menu\PROFIT.lnk
2016-01-08 09:22 - 2015-01-08 11:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LPsoft PROFIT
2016-01-08 08:34 - 2014-11-02 14:03 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-01-04 09:21 - 2015-03-25 09:38 - 00000000 ____D C:\Users\Michal\AppData\Local\Adobe
2015-12-22 10:56 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2015-12-22 10:07 - 2009-07-14 05:45 - 05196048 _____ C:\Windows\system32\FNTCACHE.DAT
2015-12-22 10:05 - 2014-11-19 13:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-12-22 10:03 - 2015-04-08 09:41 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-12-22 10:03 - 2015-04-08 09:41 - 00000000 ___SD C:\Windows\system32\GWX
2015-12-17 10:11 - 2015-01-14 10:25 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Skype
2015-12-16 13:06 - 2015-09-07 16:59 - 00001480 _____ C:\Users\Michal\AppData\Local\Adobe Uložit pro web 13.0 Prefs
2015-12-16 07:54 - 2015-01-14 10:25 - 00000000 ____D C:\Users\Michal\AppData\Local\Skype
2015-12-16 07:54 - 2015-01-14 10:25 - 00000000 ____D C:\ProgramData\Skype
2015-12-16 07:54 - 2014-11-02 11:39 - 00000000 ____D C:\Users\Michal
2015-12-15 11:59 - 2014-11-05 06:59 - 00000000 ____D C:\Users\Michal\AppData\Local\ElevatedDiagnostics
2015-12-15 08:42 - 2014-11-13 09:21 - 00000000 ____D C:\Users\Michal\AppData\Local\CrashDumps

==================== Files in the root of some directories =======

2015-03-25 11:23 - 2015-12-02 13:51 - 0000034 _____ () C:\Users\Michal\AppData\Roaming\AdobeWLCMCache.dat
2015-10-15 09:47 - 2015-10-15 10:21 - 0000268 ___RH () C:\Users\Michal\AppData\Roaming\Animals
2015-10-26 11:22 - 2015-10-26 12:02 - 0000442 _____ () C:\Users\Michal\AppData\Roaming\MICHAL-NB.MTBF.txt
2015-09-07 16:59 - 2015-12-16 13:06 - 0001480 _____ () C:\Users\Michal\AppData\Local\Adobe Uložit pro web 13.0 Prefs
2015-10-26 12:15 - 2015-10-26 12:15 - 0003584 _____ () C:\Users\Michal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-04-05 11:19 - 2015-04-05 11:19 - 0007597 _____ () C:\Users\Michal\AppData\Local\Resmon.ResmonCfg
2015-03-30 10:51 - 2015-03-30 10:51 - 0000008 __RSH () C:\ProgramData\1BABCD0E97.sys
2015-10-15 10:21 - 2015-10-15 10:21 - 0000000 _____ () C:\ProgramData\Abstract
2015-10-15 10:21 - 2015-10-15 10:21 - 0000000 _____ () C:\ProgramData\Analog Sync
2015-10-15 09:47 - 2015-10-15 10:21 - 0000268 ___RH () C:\ProgramData\Applications
2015-03-30 10:51 - 2015-12-06 10:51 - 0000952 ___SH () C:\ProgramData\KGyGaAvL.sys
2014-12-16 12:19 - 2014-12-16 12:19 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2015-06-05 12:13 - 2015-06-05 12:13 - 0000133 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
2015-11-27 19:25 - 2015-11-27 19:25 - 0000089 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2015-10-15 09:31 - 2015-11-06 17:52 - 0000020 ____H () C:\ProgramData\PKP_DLdy.DAT

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-01-09 15:30

==================== End of FRST.txt ============================

Zdravím!
Spusťte tuto utilitu:

Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

# AdwCleaner v5.029 - Logfile created 12/01/2016 at 07:05:08
# Updated 11/01/2016 by Xplode
# Database : 2016-01-11.4 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x64)
# Username : Michal - MICHAL-NB
# Running from : C:\Users\Michal\Desktop\adwcleaner_5.029.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLL ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [591 bytes] ##########

Toto je OK. Otevřte poznámkový blok a zkopírujte do něj:

Start
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Policies\Explorer: []
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {382b684f-d7a2-11e4-837b-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {a6b719d8-1817-11e5-bdda-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {e25eab06-633c-11e4-b3f8-e0cb4e9eb3ae} - F:\Autorun.exe
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1348850115-4210626098-1049065160-1000Core.job
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Users\Michal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
C:\ProgramData\1BABCD0E97.sys
C:\ProgramData\KGyGaAvL.sys
C:\ProgramData\PKP_DLdy.DAT
C:\Users\Michal\AppData\Local\Temp
AlternateDataStreams: C:\ProgramData\TEMP:FD268286

ResetHosts:
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Fix result of Farbar Recovery Scan Tool (x64) Version:09-01-2015
Ran by Michal (2016-01-13 08:28:40) Run:1
Running from C:\Users\Michal\Desktop
Loaded Profiles: Michal (Available Profiles: Michal)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\Policies\Explorer: []
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {382b684f-d7a2-11e4-837b-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {a6b719d8-1817-11e5-bdda-e0cb4e9eb3ae} - F:\Autorun.exe
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\...\MountPoints2: {e25eab06-633c-11e4-b3f8-e0cb4e9eb3ae} - F:\Autorun.exe
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1348850115-4210626098-1049065160-1000Core.job
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Users\Michal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
C:\ProgramData\1BABCD0E97.sys
C:\ProgramData\KGyGaAvL.sys
C:\ProgramData\PKP_DLdy.DAT
C:\Users\Michal\AppData\Local\Temp
AlternateDataStreams: C:\ProgramData\TEMP:FD268286

ResetHosts:
End
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => value removed successfully
HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\ => value removed successfully
"HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{382b684f-d7a2-11e4-837b-e0cb4e9eb3ae}" => key removed successfully
HKCR\CLSID\{382b684f-d7a2-11e4-837b-e0cb4e9eb3ae} => key not found.
"HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6b719d8-1817-11e5-bdda-e0cb4e9eb3ae}" => key removed successfully
HKCR\CLSID\{a6b719d8-1817-11e5-bdda-e0cb4e9eb3ae} => key not found.
"HKU\S-1-5-21-1348850115-4210626098-1049065160-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e25eab06-633c-11e4-b3f8-e0cb4e9eb3ae}" => key removed successfully
HKCR\CLSID\{e25eab06-633c-11e4-b3f8-e0cb4e9eb3ae} => key not found.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1348850115-4210626098-1049065160-1000Core.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\Users\Michal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
C:\ProgramData\1BABCD0E97.sys => moved successfully
C:\ProgramData\KGyGaAvL.sys => moved successfully
C:\ProgramData\PKP_DLdy.DAT => moved successfully

"C:\Users\Michal\AppData\Local\Temp" folder move:

Could not move "C:\Users\Michal\AppData\Local\Temp" => Scheduled to move on reboot.

C:\ProgramData\TEMP => ":FD268286" ADS removed successfully.
ResetHosts: => Error: No automatic fix found for this entry.

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2016-01-13 08:34:05)

C:\Users\Michal\AppData\Local\Temp => moved successfully

==== End of Fixlog 08:34:05 ====

Smazáno. Nastala nějaká změna?

já zatím změnu nepozoruji, PC je pořád trochu zpomalené

Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

scan proveden. Nemůže být spíše problém ve spuštěných procesech než malware, ikdyž to by asi mohlo souviset. test MAM nic nenašel

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 15.1.2016
Čas skenování: 9:14
Protokol: mam.txt
Správce: Ano

Verze: 2.2.0.1024
Databáze malwaru: v2016.01.15.03
Databáze rootkitů: v2016.01.09.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: Michal

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 358876
Uplynulý čas: 19 min, 48 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 0
(Nenalezeny žádné škodlivé položky)

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

Po virové stránce máte čisto. Co jste instaloval těsně před tím, než se problém objevil?

právě, že nic zásadního, pouze klasický provoz WIN7, internet, photoshop, cad. žádné hry.

Zkuste tedy obnovu systému k datu, kdy korektně fungoval.

to už možná raději čistý reinstal, což jsem teď nechtěl. děkuji

Divím se. Při obnově systému se vám odregistrují (znefunkční) pouze instalace provedené mez datem bodu obnovy a dneškem. Je to běžný a rychlý způsob opravy. Sice nezabere vždy, ale není od věci to zkusit.

příležitostně tedy vyzkouším.

jinak velice děkuji za scan na viry a ostatní

(můžete uzavřít)