VIRY.CZ

Něco zabírá místo na disku a je celý zpomalený.

Logfile of random's system information tool 1.10 (written by random/random)
Run by Valča at 2016-01-23 07:43:42
Microsoft Windows 7 Enterprise Service Pack 1
System drive C: has 3 GB (3%) free of 100 GB
Total RAM: 3819 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:43:59, on 23.1.2016
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18163)
Boot mode: Normal

Running processes:
C:\Users\Mamka\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Valča.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.seznam.cz/?sourceid=quick ... earchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.seznam.cz/?sourceid=quick ... earchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll
O2 - BHO: DefaultTabBHO - {7F6AFBF1-E065-4627-A2FD-810366367D01} - (no file)
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
O2 - BHO: DefaultTabToolbarBHO - {96A25A24-2E87-4374-8A50-CC6F943FCE4D} - (no file)
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - (no file)
O3 - Toolbar: (no name) - {96A25A24-2E87-4374-8A50-CC6F943FCE4D} - (no file)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\RunOnce: [20150107] C:\Program Files\AVAST Software\Avast\setup\emupdate\fae8e516-c786-45e5-9db9-bac467f677b6.exe /check
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Valča\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_DD4F918F109122146B27F9FBB40C7B24] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
O4 - HKCU\..\Run: [cz.seznam.software.autoupdate] "C:\Users\Valča\AppData\Roaming\Seznam.cz\szninstall.exe" -c
O4 - HKCU\..\Run: [cz.seznam.software.szndesktop] "C:\Users\Valča\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
O4 - HKCU\..\Run: [WebcamMaxAutoRun] "C:\Program Files (x86)\WebcamMax\wcmmon.exe" -a
O4 - HKCU\..\Run: [Zoner Photo Studio Service 16] "C:\Program Files\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXEC:\Program Files\Zoner\Photo Studio 16\Program32\ZPSService.exe"
O4 - HKCU\..\Run: [GSplay.exe] C:\Users\Val%c4%8da\Downloads\GSplay\GSplay.exe
O4 - HKCU\..\Run: [Zoner Photo Studio Autoupdate] "C:\PROGRAM FILES\ZONER\PHOTO STUDIO 16\Program32\ZPSTRAY.EXE"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
O4 - HKCU\..\Run: [iCloudPhotos] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
O4 - HKCU\..\RunOnce: [Application Restart #2] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --flag-switches-begin --flag-switches-end --restore-last-session http://www.qvo6.com/?utm_source=b&utm_m ... 1383924642
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2173376759-2515184244-441396215-1001\..\Run: [cz.seznam.software.szndesktop] "C:\Users\Mamka\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q (User 'Mamka')
O4 - HKUS\S-1-5-18\..\Run: [Pokki] "%LOCALAPPDATA%\Pokki\Engine\pokki.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe -update activex (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Pokki] "%LOCALAPPDATA%\Pokki\Engine\pokki.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe -update activex (User 'Default user')
O4 - Startup: Dropbox.lnk = ?
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{445395C6-054D-4288-AB24-31F58281FF7C}: NameServer = 62.129.50.20,62.129.32.100
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Users\VALA~1\AppData\Local\DProtect\eBP.dll,C:\Users\VALA~1\AppData\Local\DProtect\eBPSD.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device Service - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: DefaultTabSearch - Unknown owner - C:\Program Files (x86)\DefaultTab\DefaultTabSearch.exe (file missing)
O23 - Service: DefaultTabUpdate - Unknown owner - C:\Users\Valča\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13487 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\Windows\System32\spoolsv.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
"C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Windows\system32\CxAudMsg64.exe
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 2036
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\iTunes\iTunesHelper.exe"
"C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
szndesktop.exe default start
"C:\Users\Mamka\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe"
\??\C:\Windows\system32\conhost.exe "14912735141155411108744654328-847743011-287142700-2118930333-479618743860016798
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
"C:\Program Files\iPod\bin\iPodService.exe"
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -auto -scheduled -critical
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="3016.0.1094527003\1996255671" --supports-dual-gpus=false --gpu-driver-bug-workarounds=2,23,51 --disable-accelerated-video-decode --gpu-vendor-id=0x1002 --gpu-device-id=0x9807 --gpu-driver-vendor="ATI Technologies Inc." --gpu-driver-version=8.861.0.0 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AffiliationBasedMatching/EnabledThroughFieldTrial/AppBannerTriggering/Aggressive/AsyncSetAsDefault/EnabledFull/*AutomaticTabDiscarding/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/*ChromeSuggestions/Default/*ClientSideDetectionModel/Model0/*CrossDevicePromo/14DaySingleProfile/*DomRel-Enable/enable/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GFE/Default/InstanceID/Enabled/*IntelligentSessionRestore/Enabled2/*NetworkQualityEstimator/Enabled/*OmniboxBundledExperimentV1/Unused_2/PasswordBranding/Disabled/*PasswordGeneration/Disabled/*QUIC/EnabledAutoTuneReceiveWindow/ReportCertificateErrors/ShowAndPossiblySend/*ResourcePriorities/Disabled/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingSocialEngineeringStrings/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes/SafeBrowsingUpdateFrequency/Default/SessionRestoreBackgroundLoading/Restore/SlimmingPaint/EnableSlimmingPaint/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/*VarationsServiceControl/Interval_30min/WebRTC-PeerConnectionDTLS1.2/Enabled/ --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --channel="3016.2.1037357148\1735434625" --font-cache-shared-handle=2352 /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AffiliationBasedMatching/EnabledThroughFieldTrial/AppBannerTriggering/Aggressive/AsyncSetAsDefault/EnabledFull/*AutomaticTabDiscarding/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/*ChromeSuggestions/Default/*ClientSideDetectionModel/Model0/*CrossDevicePromo/14DaySingleProfile/*DomRel-Enable/enable/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GFE/Default/InstanceID/Enabled/*IntelligentSessionRestore/Enabled2/*NetworkQualityEstimator/Enabled/*OmniboxBundledExperimentV1/Unused_2/PasswordBranding/Disabled/*PasswordGeneration/Disabled/*QUIC/EnabledAutoTuneReceiveWindow/ReportCertificateErrors/ShowAndPossiblySend/*ResourcePriorities/Disabled/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingSocialEngineeringStrings/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes/SafeBrowsingUpdateFrequency/Default/SessionRestoreBackgroundLoading/Restore/SlimmingPaint/EnableSlimmingPaint/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/*VarationsServiceControl/Interval_30min/WebRTC-PeerConnectionDTLS1.2/Enabled/ --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --channel="3016.3.2098795354\1993341520" --font-cache-shared-handle=2256 /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AffiliationBasedMatching/EnabledThroughFieldTrial/AppBannerTriggering/Aggressive/AsyncSetAsDefault/EnabledFull/*AutomaticTabDiscarding/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/*ChromeSuggestions/Default/*ClientSideDetectionModel/Model0/*CrossDevicePromo/14DaySingleProfile/*DomRel-Enable/enable/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GFE/Default/InstanceID/Enabled/*IntelligentSessionRestore/Enabled2/*NetworkQualityEstimator/Enabled/*OmniboxBundledExperimentV1/Unused_2/PasswordBranding/Disabled/*PasswordGeneration/Disabled/*QUIC/EnabledAutoTuneReceiveWindow/ReportCertificateErrors/ShowAndPossiblySend/*ResourcePriorities/Disabled/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingSocialEngineeringStrings/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes/SafeBrowsingUpdateFrequency/Default/SessionRestoreBackgroundLoading/Restore/SlimmingPaint/EnableSlimmingPaint/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/*VarationsServiceControl/Interval_30min/WebRTC-PeerConnectionDTLS1.2/Enabled/ --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --channel="3016.4.2064550429\1629324392" --font-cache-shared-handle=3500 /prefetch:673131151
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AffiliationBasedMatching/EnabledThroughFieldTrial/AppBannerTriggering/Aggressive/AsyncSetAsDefault/EnabledFull/*AutomaticTabDiscarding/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/*ChromeSuggestions/Default/*ClientSideDetectionModel/Model0/*CrossDevicePromo/14DaySingleProfile/*DomRel-Enable/enable/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GFE/Default/InstanceID/Enabled/*IntelligentSessionRestore/Enabled2/*NetworkQualityEstimator/Enabled/*OmniboxBundledExperimentV1/Unused_2/*PasswordBranding/Disabled/*PasswordGeneration/Disabled/*QUIC/EnabledAutoTuneReceiveWindow/ReportCertificateErrors/ShowAndPossiblySend/*ResourcePriorities/Disabled/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingSocialEngineeringStrings/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes/*SafeBrowsingUpdateFrequency/Default/SessionRestoreBackgroundLoading/Restore/SlimmingPaint/EnableSlimmingPaint/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/*VarationsServiceControl/Interval_30min/WebRTC-PeerConnectionDTLS1.2/Enabled/ --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --channel="3016.22.222631151\61176792" --font-cache-shared-handle=3812 /prefetch:673131151
C:\Windows\system32\sppsvc.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe18_ Global\UsGthrCtrlFltPipeMssGthrPipe18 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 508 512 520 65536 516

"C:\Users\Mamka\Desktop\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2173376759-2515184244-441396215-1000Core.job - C:\Users\Valča\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2173376759-2515184244-441396215-1000UA.job - C:\Users\Valča\AppData\Local\Facebook\Update\FacebookUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA1cf9139ac547c07.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\Norton Security Scan for Valča.job - C:\PROGRA~2\NORTON~2\Engine\430~1.43\Nss.exe /scan-quick /scheduled

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-01-13 885152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 529664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-10-15 460384]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01}]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-01-13 664184]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení k účtu Microsoft - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 441592]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96A25A24-2E87-4374-8A50-CC6F943FCE4D}]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-10-15 172640]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{96A25A24-2E87-4374-8A50-CC6F943FCE4D}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-01-13 2538280]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2012-11-05 108144]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2015-12-17 170256]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"=C:\Users\Valča\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-07-02 138096]
"GoogleChromeAutoLaunch_DD4F918F109122146B27F9FBB40C7B24"=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [2016-01-12 748360]
"cz.seznam.software.autoupdate"=C:\Users\Valča\AppData\Roaming\Seznam.cz\szninstall.exe [2013-05-16 1062472]
"cz.seznam.software.szndesktop"=C:\Users\Valča\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [2015-05-26 103080]
"WebcamMaxAutoRun"=C:\Program Files (x86)\WebcamMax\wcmmon.exe [2011-07-17 1038848]
"Zoner Photo Studio Service 16"=C:\Program Files\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXE [2013-09-16 800280]
"GSplay.exe"=C:\Users\Val8da\Downloads\GSplay\GSplay.exe []
"Zoner Photo Studio Autoupdate"=C:\PROGRAM FILES\ZONER\PHOTO STUDIO 16\Program32\ZPSTRAY.EXE [2013-09-16 800280]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2015-11-30 50509440]
"iCloudServices"=C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [2015-11-30 60688]
"iCloudPhotos"=C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [2015-11-30 349968]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-12-08 8590760]
"ApplePhotoStreams"=C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [2015-11-30 61200]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Application Restart #2"=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [2016-01-12 748360]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-05-24 336384]
"seznam-listicka-distribuce"=C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [2013-05-16 1062472]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2016-01-13 7021880]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-06-08 334896]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce]
"20150107"=C:\Program Files\AVAST Software\Avast\setup\emupdate\fae8e516-c786-45e5-9db9-bac467f677b6.exe [2016-01-22 168336]

C:\Users\Valča\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\Valča\AppData\Roaming\Dropbox\bin\Dropbox.exe
Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk - C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv
"wave3"=wdmaud.drv
"mixer3"=wdmaud.drv
"midi3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"aux2"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux3"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"aux4"=wdmaud.drv
"wave7"=wdmaud.drv
"mixer7"=wdmaud.drv
"midi7"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2016-01-23 07:43:42 ----D---- C:\rsit
2016-01-23 07:43:42 ----D---- C:\Program Files\trend micro
2016-01-19 20:05:07 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe
2016-01-15 07:03:42 ----D---- C:\ProgramData\Package Cache
2016-01-13 08:05:17 ----A---- C:\Windows\SYSWOW64\mapistub.dll
2016-01-13 08:05:17 ----A---- C:\Windows\SYSWOW64\mapi32.dll
2016-01-13 08:05:17 ----A---- C:\Windows\SYSWOW64\fixmapi.exe
2016-01-13 08:05:17 ----A---- C:\Windows\system32\mapistub.dll
2016-01-13 08:05:17 ----A---- C:\Windows\system32\mapi32.dll
2016-01-13 08:05:17 ----A---- C:\Windows\system32\fixmapi.exe
2016-01-13 08:05:17 ----A---- C:\Windows\system32\aeinv.dll
2016-01-13 08:05:16 ----A---- C:\Windows\system32\qedit.dll
2016-01-13 08:05:15 ----A---- C:\Windows\SYSWOW64\qedit.dll
2016-01-13 08:05:13 ----A---- C:\Windows\system32\WMVDECOD.DLL
2016-01-13 08:05:13 ----A---- C:\Windows\system32\WMADMOD.DLL
2016-01-13 08:05:13 ----A---- C:\Windows\system32\msmpeg2adec.dll
2016-01-13 08:05:12 ----A---- C:\Windows\SYSWOW64\WMVDECOD.DLL
2016-01-13 08:05:12 ----A---- C:\Windows\SYSWOW64\msmpeg2adec.dll
2016-01-13 08:05:12 ----A---- C:\Windows\system32\WMSPDMOD.DLL
2016-01-13 08:05:11 ----A---- C:\Windows\SYSWOW64\WMADMOD.DLL
2016-01-13 08:05:11 ----A---- C:\Windows\system32\WMVSDECD.DLL
2016-01-13 08:05:11 ----A---- C:\Windows\system32\MSMPEG2ENC.DLL
2016-01-13 08:05:11 ----A---- C:\Windows\system32\mf.dll
2016-01-13 08:05:10 ----A---- C:\Windows\SYSWOW64\MSMPEG2ENC.DLL
2016-01-13 08:05:09 ----A---- C:\Windows\SYSWOW64\WMVSDECD.DLL
2016-01-13 08:05:09 ----A---- C:\Windows\SYSWOW64\WMSPDMOD.DLL
2016-01-13 08:05:09 ----A---- C:\Windows\SYSWOW64\mf.dll
2016-01-13 08:05:09 ----A---- C:\Windows\system32\WMADMOE.DLL
2016-01-13 08:05:08 ----A---- C:\Windows\SYSWOW64\WMADMOE.DLL
2016-01-13 08:05:08 ----A---- C:\Windows\system32\mcmde.dll
2016-01-13 08:05:07 ----A---- C:\Windows\SYSWOW64\WMVENCOD.DLL
2016-01-13 08:05:07 ----A---- C:\Windows\SYSWOW64\wmpmde.dll
2016-01-13 08:05:07 ----A---- C:\Windows\SYSWOW64\COLORCNV.DLL
2016-01-13 08:05:07 ----A---- C:\Windows\system32\WMVENCOD.DLL
2016-01-13 08:05:07 ----A---- C:\Windows\system32\wmpmde.dll
2016-01-13 08:05:07 ----A---- C:\Windows\system32\quartz.dll
2016-01-13 08:05:07 ----A---- C:\Windows\system32\evr.dll
2016-01-13 08:05:07 ----A---- C:\Windows\system32\COLORCNV.DLL
2016-01-13 08:05:06 ----A---- C:\Windows\SYSWOW64\WMVXENCD.DLL
2016-01-13 08:05:06 ----A---- C:\Windows\SYSWOW64\quartz.dll
2016-01-13 08:05:06 ----A---- C:\Windows\SYSWOW64\evr.dll
2016-01-13 08:05:06 ----A---- C:\Windows\system32\WMVXENCD.DLL
2016-01-13 08:05:06 ----A---- C:\Windows\system32\WMSPDMOE.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\SYSWOW64\qdvd.dll
2016-01-13 08:05:05 ----A---- C:\Windows\SYSWOW64\mfplat.dll
2016-01-13 08:05:05 ----A---- C:\Windows\SYSWOW64\devenum.dll
2016-01-13 08:05:05 ----A---- C:\Windows\system32\WMVSENCD.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\VIDRESZR.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\MPG4DECD.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\MP4SDECD.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\MP43DECD.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\MFWMAAEC.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\mfplat.dll
2016-01-13 08:05:05 ----A---- C:\Windows\system32\devenum.dll
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\WMVSENCD.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\WMSPDMOE.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\qasf.dll
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\msmpeg2vdec.dll
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\MPG4DECD.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\MP43DECD.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\MFWMAAEC.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\system32\RESAMPLEDMO.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\system32\qdvd.dll
2016-01-13 08:05:04 ----A---- C:\Windows\system32\MP3DMOD.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\system32\mfvdsp.dll
2016-01-13 08:05:03 ----A---- C:\Windows\SYSWOW64\VIDRESZR.DLL
2016-01-13 08:05:03 ----A---- C:\Windows\SYSWOW64\RESAMPLEDMO.DLL
2016-01-13 08:05:03 ----A---- C:\Windows\SYSWOW64\MP4SDECD.DLL
2016-01-13 08:05:03 ----A---- C:\Windows\SYSWOW64\MP3DMOD.DLL
2016-01-13 08:05:03 ----A---- C:\Windows\system32\SysFxUI.dll
2016-01-13 08:05:03 ----A---- C:\Windows\system32\qasf.dll
2016-01-13 08:05:03 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2016-01-13 08:05:02 ----A---- C:\Windows\SYSWOW64\rrinstaller.exe
2016-01-13 08:05:02 ----A---- C:\Windows\SYSWOW64\mfvdsp.dll
2016-01-13 08:05:02 ----A---- C:\Windows\SYSWOW64\mfps.dll
2016-01-13 08:05:02 ----A---- C:\Windows\SYSWOW64\mfpmp.exe
2016-01-13 08:05:02 ----A---- C:\Windows\system32\rrinstaller.exe
2016-01-13 08:05:02 ----A---- C:\Windows\system32\mfps.dll
2016-01-13 08:05:02 ----A---- C:\Windows\system32\mfpmp.exe
2016-01-13 08:05:02 ----A---- C:\Windows\system32\drivers\portcls.sys
2016-01-13 08:05:00 ----A---- C:\Windows\SYSWOW64\mferror.dll
2016-01-13 08:05:00 ----A---- C:\Windows\SYSWOW64\ksuser.dll
2016-01-13 08:05:00 ----A---- C:\Windows\system32\mferror.dll
2016-01-13 08:05:00 ----A---- C:\Windows\system32\ksuser.dll
2016-01-13 08:05:00 ----A---- C:\Windows\system32\drivers\drmkaud.sys
2016-01-13 08:05:00 ----A---- C:\Windows\system32\drivers\drmk.sys
2016-01-13 08:04:57 ----A---- C:\Windows\system32\win32k.sys
2016-01-13 08:04:49 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2016-01-13 08:04:49 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2016-01-13 08:04:49 ----A---- C:\Windows\system32\iertutil.dll
2016-01-13 08:04:49 ----A---- C:\Windows\system32\ieetwcollector.exe
2016-01-13 08:04:48 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2016-01-13 08:04:48 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2016-01-13 08:04:48 ----A---- C:\Windows\system32\ieetwproxystub.dll
2016-01-13 08:04:47 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\occache.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2016-01-13 08:04:46 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-01-13 08:04:46 ----A---- C:\Windows\system32\iernonce.dll
2016-01-13 08:04:46 ----A---- C:\Windows\system32\ie4uinit.exe
2016-01-13 08:04:45 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2016-01-13 08:04:45 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2016-01-13 08:04:42 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2016-01-13 08:04:42 ----A---- C:\Windows\SYSWOW64\jscript.dll
2016-01-13 08:04:42 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2016-01-13 08:04:42 ----A---- C:\Windows\system32\urlmon.dll
2016-01-13 08:04:42 ----A---- C:\Windows\system32\occache.dll
2016-01-13 08:04:42 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2016-01-13 08:04:42 ----A---- C:\Windows\system32\iedkcs32.dll
2016-01-13 08:04:41 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2016-01-13 08:04:41 ----A---- C:\Windows\SYSWOW64\ieui.dll
2016-01-13 08:04:41 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2016-01-13 08:04:41 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2016-01-13 08:04:41 ----A---- C:\Windows\system32\msfeeds.dll
2016-01-13 08:04:41 ----A---- C:\Windows\system32\dxtrans.dll
2016-01-13 08:04:40 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2016-01-13 08:04:39 ----A---- C:\Windows\system32\iesetup.dll
2016-01-13 08:04:37 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2016-01-13 08:04:37 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2016-01-13 08:04:36 ----A---- C:\Windows\SYSWOW64\wininet.dll
2016-01-13 08:04:36 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2016-01-13 08:04:36 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2016-01-13 08:04:36 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2016-01-13 08:04:36 ----A---- C:\Windows\system32\vbscript.dll
2016-01-13 08:04:35 ----A---- C:\Windows\SYSWOW64\msrating.dll
2016-01-13 08:04:35 ----A---- C:\Windows\system32\jsproxy.dll
2016-01-13 08:04:34 ----A---- C:\Windows\system32\ieui.dll
2016-01-13 08:04:34 ----A---- C:\Windows\system32\dxtmsft.dll
2016-01-13 08:04:33 ----A---- C:\Windows\system32\ieframe.dll
2016-01-13 08:04:32 ----A---- C:\Windows\system32\mshtmlmedia.dll
2016-01-13 08:04:32 ----A---- C:\Windows\system32\mshtmled.dll
2016-01-13 08:04:31 ----A---- C:\Windows\system32\webcheck.dll
2016-01-13 08:04:31 ----A---- C:\Windows\system32\jscript.dll
2016-01-13 08:04:31 ----A---- C:\Windows\system32\ieUnatt.exe
2016-01-13 08:04:30 ----A---- C:\Windows\system32\jscript9diag.dll
2016-01-13 08:04:30 ----A---- C:\Windows\system32\jscript9.dll
2016-01-13 08:04:29 ----A---- C:\Windows\system32\wininet.dll
2016-01-13 08:04:29 ----A---- C:\Windows\system32\ieapfltr.dll
2016-01-13 08:04:27 ----A---- C:\Windows\system32\msrating.dll
2016-01-13 08:04:27 ----A---- C:\Windows\system32\MshtmlDac.dll
2016-01-13 08:04:26 ----A---- C:\Windows\system32\mshtml.dll
2016-01-13 08:03:50 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2016-01-13 08:03:50 ----A---- C:\Windows\system32\advapi32.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\invagent.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\generaltel.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\devinv.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\CompatTelRunner.exe
2016-01-13 08:03:48 ----A---- C:\Windows\system32\appraiser.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\aepic.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\acmigration.dll
2016-01-13 08:03:46 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2016-01-13 08:03:46 ----A---- C:\Windows\system32\gdi32.dll
2016-01-13 08:03:37 ----A---- C:\Windows\system32\rpcrt4.dll
2016-01-13 08:03:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2016-01-13 08:03:35 ----A---- C:\Windows\system32\schannel.dll
2016-01-13 08:03:35 ----A---- C:\Windows\system32\kerberos.dll
2016-01-13 08:03:34 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2016-01-13 08:03:33 ----A---- C:\Windows\SYSWOW64\schannel.dll
2016-01-13 08:03:33 ----A---- C:\Windows\system32\lsasrv.dll
2016-01-13 08:03:32 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2016-01-13 08:03:32 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2016-01-13 08:03:32 ----A---- C:\Windows\system32\ncrypt.dll
2016-01-13 08:03:31 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2016-01-13 08:03:31 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2016-01-13 08:03:31 ----A---- C:\Windows\system32\TSpkg.dll
2016-01-13 08:03:31 ----A---- C:\Windows\system32\msv1_0.dll
2016-01-13 08:03:31 ----A---- C:\Windows\system32\kernel32.dll
2016-01-13 08:03:31 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2016-01-13 08:03:30 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2016-01-13 08:03:30 ----A---- C:\Windows\system32\wdigest.dll
2016-01-13 08:03:29 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2016-01-13 08:03:29 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2016-01-13 08:03:29 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2016-01-13 08:03:29 ----A---- C:\Windows\system32\ntdll.dll
2016-01-13 08:03:29 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2016-01-13 08:03:28 ----A---- C:\Windows\SYSWOW64\credssp.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\winsrv.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\sspicli.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\secur32.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\cryptbase.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\credssp.dll
2016-01-13 08:03:27 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2016-01-13 08:03:27 ----A---- C:\Windows\SYSWOW64\secur32.dll
2016-01-13 08:03:27 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2016-01-13 08:03:27 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2016-01-13 08:03:27 ----A---- C:\Windows\system32\sspisrv.dll
2016-01-13 08:03:27 ----A---- C:\Windows\system32\smss.exe
2016-01-13 08:03:27 ----A---- C:\Windows\system32\ntvdm64.dll
2016-01-13 08:03:27 ----A---- C:\Windows\system32\lsass.exe
2016-01-13 08:03:27 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2016-01-13 08:03:27 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2016-01-13 08:03:26 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\wow64win.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\wow64.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\srcore.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\KernelBase.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2016-01-13 08:03:26 ----A---- C:\Windows\system32\conhost.exe
2016-01-13 08:03:25 ----A---- C:\Windows\SYSWOW64\srclient.dll
2016-01-13 08:03:25 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2016-01-13 08:03:25 ----A---- C:\Windows\system32\wow64cpu.dll
2016-01-13 08:03:25 ----A---- C:\Windows\system32\srclient.dll
2016-01-13 08:03:25 ----A---- C:\Windows\system32\rstrui.exe
2016-01-13 08:03:25 ----A---- C:\Windows\system32\csrsrv.dll
2016-01-13 08:03:25 ----A---- C:\Windows\system32\auditpol.exe
2016-01-13 08:03:24 ----A---- C:\Windows\SYSWOW64\wow32.dll
2016-01-13 08:03:24 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2016-01-13 08:03:24 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2016-01-13 08:03:24 ----A---- C:\Windows\system32\apisetschema.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-01-13 08:03:23 ----A---- C:\Windows\SYSWOW64\instnm.exe
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-01-13 08:03:22 ----A---- C:\Windows\SYSWOW64\setup16.exe
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-01-13 08:03:20 ----A---- C:\Windows\SYSWOW64\user.exe
2016-01-13 08:03:20 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2016-01-13 08:03:20 ----A---- C:\Windows\system32\adtschema.dll
2016-01-13 08:03:19 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2016-01-13 08:03:19 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2016-01-13 08:03:19 ----A---- C:\Windows\system32\msobjs.dll
2016-01-13 08:03:19 ----A---- C:\Windows\system32\msaudite.dll
2016-01-13 06:36:32 ----A---- C:\Windows\system32\aswBoot.exe
2016-01-13 06:36:15 ----A---- C:\Windows\avastSS.scr
2016-01-08 20:40:01 ----D---- C:\Program Files\CCleaner
2016-01-08 20:04:43 ----A---- C:\Windows\system32\drivers\mwac.sys
2016-01-08 20:04:43 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2016-01-08 20:04:42 ----D---- C:\ProgramData\Malwarebytes
2016-01-08 20:04:42 ----A---- C:\Windows\system32\drivers\mbam.sys
2015-12-24 18:36:07 ----D---- C:\Program Files (x86)\iTunes
2015-12-24 18:36:06 ----D---- C:\Program Files\iPod
2015-12-24 18:36:01 ----D---- C:\Program Files\iTunes
2015-12-24 18:16:55 ----D---- C:\Program Files\Common Files\Apple

======List of files/folders modified in the last 1 month======

2016-01-23 07:43:56 ----D---- C:\Windows\Prefetch
2016-01-23 07:43:47 ----D---- C:\Windows\Temp
2016-01-23 07:43:42 ----RD---- C:\Program Files
2016-01-23 06:56:05 ----D---- C:\Windows\system32\config
2016-01-23 06:43:07 ----SHD---- C:\System Volume Information
2016-01-23 06:32:05 ----D---- C:\Windows\System32
2016-01-23 06:32:05 ----A---- C:\Windows\system32\PerfStringBackup.INI
2016-01-23 06:32:04 ----D---- C:\Windows\inf
2016-01-21 06:36:52 ----D---- C:\Windows\system32\drivers
2016-01-19 20:05:25 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2016-01-19 20:05:07 ----D---- C:\Windows\SysWOW64
2016-01-18 14:15:23 ----D---- C:\Windows\tracing
2016-01-17 17:02:08 ----D---- C:\Users\Valča\AppData\Roaming\Seznam.cz
2016-01-17 16:58:58 ----D---- C:\Users\Valča\AppData\Roaming\Skype
2016-01-17 16:58:21 ----D---- C:\Users\Valča\AppData\Roaming\Dropbox
2016-01-17 16:58:13 ----D---- C:\Users\Valča\AppData\Roaming\DropboxMaster
2016-01-16 20:37:45 ----D---- C:\Windows\rescache
2016-01-16 07:38:37 ----D---- C:\Windows\winsxs
2016-01-16 07:36:41 ----D---- C:\Windows\SYSWOW64\cs-CZ
2016-01-16 07:36:40 ----D---- C:\Windows\system32\cs-CZ
2016-01-16 07:36:39 ----D---- C:\Windows\AppPatch
2016-01-16 07:21:03 ----SHD---- C:\Windows\Installer
2016-01-16 07:21:03 ----SHD---- C:\Config.Msi
2016-01-15 07:50:31 ----D---- C:\Program Files\Microsoft Silverlight
2016-01-15 07:50:30 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2016-01-15 07:48:49 ----D---- C:\Windows\SYSWOW64\en-US
2016-01-15 07:48:49 ----D---- C:\Program Files\Internet Explorer
2016-01-15 07:48:48 ----D---- C:\Windows\system32\en-US
2016-01-15 07:48:47 ----D---- C:\Program Files (x86)\Internet Explorer
2016-01-15 07:48:46 ----SD---- C:\Windows\system32\CompatTel
2016-01-15 07:48:46 ----D---- C:\Windows\system32\appraiser
2016-01-15 07:48:44 ----D---- C:\Windows\system32\DriverStore
2016-01-15 07:47:37 ----D---- C:\ProgramData\Microsoft Help
2016-01-15 07:40:46 ----A---- C:\Windows\win.ini
2016-01-15 07:20:38 ----D---- C:\Windows\system32\MRT
2016-01-15 07:20:37 ----D---- C:\Windows\debug
2016-01-15 07:20:28 ----A---- C:\Windows\system32\MRT.exe
2016-01-15 07:03:42 ----HD---- C:\ProgramData
2016-01-13 07:59:57 ----D---- C:\Windows\system32\catroot2
2016-01-13 06:36:49 ----D---- C:\Windows\system32\Tasks
2016-01-13 06:36:30 ----D---- C:\Windows
2016-01-08 20:45:05 ----D---- C:\Users\Valča\AppData\Roaming\DAEMON Tools Lite
2016-01-08 20:44:31 ----D---- C:\Windows\ModemLogs
2016-01-08 20:44:29 ----D---- C:\Windows\Minidump
2016-01-08 20:44:29 ----D---- C:\Windows\Logs
2015-12-26 10:45:47 ----D---- C:\Users\Valča\AppData\Roaming\Apple Computer
2015-12-25 14:07:59 ----D---- C:\Windows\Microsoft.NET
2015-12-24 19:11:21 ----RD---- C:\Program Files (x86)
2015-12-24 18:36:01 ----D---- C:\ProgramData\Apple Computer
2015-12-24 18:19:37 ----D---- C:\Program Files (x86)\Apple Software Update
2015-12-24 18:19:21 ----D---- C:\ProgramData\Apple
2015-12-24 18:19:09 ----D---- C:\Windows\system32\catroot
2015-12-24 18:18:08 ----D---- C:\Program Files\Bonjour
2015-12-24 18:18:08 ----D---- C:\Program Files (x86)\Bonjour
2015-12-24 18:16:55 ----D---- C:\Program Files\Common Files
2015-12-24 07:16:42 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2016-01-13 65224]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2016-01-13 273784]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2016-01-13 93528]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2016-01-21 1065208]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2016-01-21 464256]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [2015-09-24 498512]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2016-01-13 28656]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2016-01-13 97648]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2016-01-13 155304]
R2 WCMVCAM;WebcamMax, WDM Video Capture; C:\Windows\system32\DRIVERS\wcmvcam64.sys [2012-04-15 1071032]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-05-24 9359872]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-05-24 309760]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-04-29 2727424]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2011-03-30 114704]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2011-03-25 1583744]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2011-01-25 77424]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-01-13 1412144]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2010-11-28 44672]
S3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys []
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys []
S3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys []
S3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys []
S3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys []
S3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys []
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device; C:\Windows\system32\DRIVERS\ew_hwusbdev.sys []
S3 ew_usbenumfilter;huawei_CompositeFilter; C:\Windows\system32\DRIVERS\ew_usbenumfilter.sys []
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2014-03-31 58056]
S3 huawei_cdcacm;huawei_cdcacm; C:\Windows\system32\DRIVERS\ew_jucdcacm.sys []
S3 huawei_enumerator;huawei_enumerator; C:\Windows\system32\DRIVERS\ew_jubusenum.sys []
S3 huawei_ext_ctrl;huawei_ext_ctrl; C:\Windows\system32\DRIVERS\ew_juextctrl.sys []
S3 huawei_wwanecm;huawei_wwanecm; C:\Windows\system32\DRIVERS\ew_juwwanecm.sys []
S3 netr28ux;RT2870 USB Wireless LAN Card Driver pro systém Windows Vista; C:\Windows\system32\DRIVERS\netr28ux.sys [2009-06-10 867328]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2013-02-19 19456]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-12-01 250984]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [2010-11-21 88960]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2013-02-19 29696]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-02-19 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2013-02-19 30208]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2015-06-17 54784]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-10-09 42496]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-12-13 82128]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-05-24 204288]
R2 Apple Mobile Device Service;Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2015-10-07 77104]
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2016-01-13 226440]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2015-08-12 462096]
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2010-12-17 198784]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2012-07-17 2292480]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2015-12-17 644880]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
S2 DefaultTabSearch;DefaultTabSearch; C:\Program Files (x86)\DefaultTab\DefaultTabSearch.exe []
S2 DefaultTabUpdate;DefaultTabUpdate; C:\Users\Valča\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe []
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-07-09 327296]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-01-19 269504]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2014-03-31 1512640]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-12-12 114688]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2013-12-19 50942144]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-04-21 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]

-----------------EOF-----------------

Zdravím!
Jak je na tom váš oper. systém s legalitou?

Tohle není můj notebook, ale měla by to být multilicence ze školy.

OK. Spusťte tuto utilitu:

Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

# AdwCleaner v5.030 - Logfile created 23/01/2016 at 18:09:27
# Updated 17/01/2016 by Xplode
# Database : 2016-01-19.2 [Server]
# Operating system : Windows 7 Enterprise Service Pack 1 (x64)
# Username : Valča - VALERIE
# Running from : C:\Users\Mamka\Desktop\adwcleaner_5.030.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

[-] Service Deleted : DefaultTabSearch
[-] Service Deleted : DefaultTabUpdate

***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\AVG Security Toolbar
[-] Folder Deleted : C:\Program Files (x86)\Babylon
[-] Folder Deleted : C:\Program Files (x86)\OApps
[-] Folder Deleted : C:\Program Files (x86)\Search Results Toolbar
[-] Folder Deleted : C:\Program Files (x86)\Common Files\Spigot
[-] Folder Deleted : C:\ProgramData\apn
[-] Folder Deleted : C:\ProgramData\Ask
[-] Folder Deleted : C:\ProgramData\Babylon
[+] Folder Deleted : C:\ProgramData\Browser Manager
[-] Folder Deleted : C:\ProgramData\eSafe
[-] Folder Deleted : C:\ProgramData\ICQ\ICQToolbar
[-] Folder Deleted : C:\ProgramData\Tarma Installer
[-] Folder Deleted : C:\Users\Valča\AppData\Local\AVG Secure Search
[-] Folder Deleted : C:\Users\Valča\AppData\Local\Babylon
[-] Folder Deleted : C:\Users\Valča\AppData\Local\DProtect
[-] Folder Deleted : C:\Users\Valča\AppData\Local\pokki
[-] Folder Deleted : C:\Users\Valča\AppData\Local\TNT2
[-] Folder Deleted : C:\Users\Valča\AppData\Local\torch
[-] Folder Deleted : C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo
[-] Folder Deleted : C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Extensions\odhkadhmcmknhbdekepokcbnipebjdei
[-] Folder Deleted : C:\Users\Valča\AppData\LocalLow\ilividtoolbarguid
[-] Folder Deleted : C:\Users\Valča\AppData\Roaming\Babylon
[-] Folder Deleted : C:\Users\Valča\AppData\Roaming\OpenCandy
[-] Folder Deleted : C:\Users\Valča\AppData\Roaming\Updater
[-] Folder Deleted : C:\Users\Valča\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\pokki
[-] Folder Deleted : C:\Users\Valča\AppData\Roaming\Mozilla\Firefox\Profiles\5j245cu7.default\Extensions\ascsurfingprotection@iobit.com

***** [ Files ] *****

[-] File Deleted : C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mhkaekfpcppmmioggniknbnbdbcigpkk
[-] File Deleted : C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_odhkadhmcmknhbdekepokcbnipebjdei_0.localstorage
[-] File Deleted : C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_odhkadhmcmknhbdekepokcbnipebjdei_0.localstorage-journal
[-] File Deleted : C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx
[-] File Deleted : C:\Users\Valča\AppData\Roaming\Mozilla\Firefox\Profiles\5j245cu7.default\user.js

***** [ DLLs ] *****


***** [ Shortcuts ] *****

[-] Shortcut Disinfected : C:\Users\Valča\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[-] Shortcut Disinfected : C:\Users\Valča\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
[-] Shortcut Disinfected : C:\Users\Valča\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
[-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\DefaultTabBHO.DLL
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
[-] Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [12x3q@3244516.com]
[-] Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [ext@bettersurfplus.com]
[-] Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [xz123@ya456.com]
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dedmngkbaffkenlfdcbganndoghblmap
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\poheodfamflhhhdcmjfeggbgigeefaco
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mmifolfpllfdhilecpdpmemhelmanajl
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{38495740-0035-4471-851E-F5BBB86AB085}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{72D89EBF-0C5D-4190-91FD-398E45F1D007}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
[-] Key Deleted : HKCU\Software\Classes\CLSID\{DD260902-9420-4055-A956-9152EB4F3E6A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96A25A24-2E87-4374-8A50-CC6F943FCE4D}
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{03EB0E9C-7A91-4381-A220-9B52B641CDB1}
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{03EB0E9C-7A91-4381-A220-9B52B641CDB1}
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F6AFBF1-E065-4627-A2FD-810366367D01}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{96A25A24-2E87-4374-8A50-CC6F943FCE4D}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2D33ED6-EBBD-467C-BF6F-F175D9B51363}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAD84EE2-624D-4E7C-A8BB-41EFD720FD77}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key Deleted : HKCU\Software\AVG Secure Search
[-] Key Deleted : HKCU\Software\AVG Security Toolbar
[-] Key Deleted : HKCU\Software\Default Tab
[-] Key Deleted : HKCU\Software\DefaultTab
[-] Key Deleted : HKCU\Software\InstallCore
[-] Key Deleted : HKCU\Software\Pokki
[-] Key Deleted : HKCU\Software\TNT2
[-] Key Deleted : HKCU\Software\UpdateStar
[-] Key Deleted : HKCU\Software\AppDataLow\Software\DefaultTab
[-] Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
[-] Key Deleted : HKLM\SOFTWARE\Babylon
[-] Key Deleted : HKLM\SOFTWARE\Better Surf Plus
[-] Key Deleted : HKLM\SOFTWARE\BetterSurf
[-] Key Deleted : HKLM\SOFTWARE\Better-Surf
[-] Key Deleted : HKLM\SOFTWARE\Default Tab
[-] Key Deleted : HKLM\SOFTWARE\DefaultTab
[-] Key Deleted : HKLM\SOFTWARE\delta-homesSoftware
[-] Key Deleted : HKLM\SOFTWARE\DProtect
[-] Key Deleted : HKLM\SOFTWARE\eSafeSecControl
[-] Key Deleted : HKLM\SOFTWARE\ICQ\ICQToolbar
[-] Key Deleted : HKLM\SOFTWARE\qvo6Software
[-] Key Deleted : HKLM\SOFTWARE\Webexp Enhanced
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab Chrome
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DProtect
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sl-dlc
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Webexp Enhanced
[-] Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer
[-] Key Deleted : HKU\.DEFAULT\Software\AskPartnerNetwork
[-] Key Deleted : HKU\.DEFAULT\Software\DefaultTab
[-] Key Deleted : HKU\.DEFAULT\Software\IObit Apps
[-] Key Deleted : HKU\.DEFAULT\Software\Pokki
[-] Key Deleted : HKU\.DEFAULT\Software\Search Settings
[-] Key Deleted : HKU\.DEFAULT\Software\VNT
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\DefaultTab
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\IObit Apps
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\Search Settings
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
[!] Data Not Restored : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
[-] Data Restored : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Data Restored : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{55E53A25-6C70-4B82-B5A7-F8559C5F73E2}
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{970189F9-AEBD-4703-93C0-499E8CA00B9B}
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{DA38563A-7DA1-453E-9396-F0AD9846F626}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
[-] Data Restored : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{5E2B536F-83AD-474C-B6F8-0310D8964E64}
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs]
[-] Value Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run [Pokki]

***** [ Web browsers ] *****

[-] [C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : search.qvo6.com
[-] [C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : search.delta-homes.com
[-] [C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : www.search.ask.com
[-] [C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : icq
[-] [C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask search
[-] [C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : gotclip-downloader.en.softonic.com
[-] [C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : ifohbjbgfchkkfhphahclmkpgejiplfo
[-] [C:\Users\Valča\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : odhkadhmcmknhbdekepokcbnipebjdei

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - \AdwCleaner\AdwCleaner[C1].txt - [16040 bytes] ##########

Dejte nový log RSIT.

Logfile of random's system information tool 1.10 (written by random/random)
Run by Valča at 2016-01-23 18:37:47
Microsoft Windows 7 Enterprise Service Pack 1
System drive C: has 4 GB (4%) free of 100 GB
Total RAM: 3819 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:37:55, on 23.1.2016
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18163)
Boot mode: Normal

Running processes:
C:\Users\Mamka\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Valča.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.seznam.cz/?sourceid=quick ... earchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.seznam.cz/?sourceid=quick ... earchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {96A25A24-2E87-4374-8A50-CC6F943FCE4D} - (no file)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\RunOnce: [20150107] C:\Program Files\AVAST Software\Avast\setup\emupdate\fae8e516-c786-45e5-9db9-bac467f677b6.exe /check
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Valča\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_DD4F918F109122146B27F9FBB40C7B24] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
O4 - HKCU\..\Run: [cz.seznam.software.autoupdate] "C:\Users\Valča\AppData\Roaming\Seznam.cz\szninstall.exe" -c
O4 - HKCU\..\Run: [cz.seznam.software.szndesktop] "C:\Users\Valča\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
O4 - HKCU\..\Run: [WebcamMaxAutoRun] "C:\Program Files (x86)\WebcamMax\wcmmon.exe" -a
O4 - HKCU\..\Run: [Zoner Photo Studio Service 16] "C:\Program Files\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXEC:\Program Files\Zoner\Photo Studio 16\Program32\ZPSService.exe"
O4 - HKCU\..\Run: [GSplay.exe] C:\Users\Val%c4%8da\Downloads\GSplay\GSplay.exe
O4 - HKCU\..\Run: [Zoner Photo Studio Autoupdate] "C:\PROGRAM FILES\ZONER\PHOTO STUDIO 16\Program32\ZPSTRAY.EXE"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
O4 - HKCU\..\Run: [iCloudPhotos] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
O4 - HKCU\..\RunOnce: [Application Restart #2] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --flag-switches-begin --flag-switches-end --restore-last-session http://www.qvo6.com/?utm_source=b&utm_m ... 1383924642
O4 - HKCU\..\RunOnce: [Report] \AdwCleaner\AdwCleaner[C1].txt
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2173376759-2515184244-441396215-1001\..\Run: [cz.seznam.software.szndesktop] "C:\Users\Mamka\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q (User 'Mamka')
O4 - HKUS\S-1-5-18\..\Run: [Advanced SystemCare 6] "C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCTray.exe" /AutoStart (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe -update activex (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Advanced SystemCare 6] "C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCTray.exe" /AutoStart (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe -update activex (User 'Default user')
O4 - Startup: Dropbox.lnk = ?
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{445395C6-054D-4288-AB24-31F58281FF7C}: NameServer = 62.129.50.20,62.129.32.100
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Users\VALA~1\AppData\Local\DProtect\eBP.dll,C:\Users\VALA~1\AppData\Local\DProtect\eBPSD.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device Service - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13087 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\Windows\System32\spoolsv.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
"C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Windows\system32\CxAudMsg64.exe
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 2036
"taskhost.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\iTunes\iTunesHelper.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
szndesktop.exe default start
"C:\Users\Mamka\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe"
\??\C:\Windows\system32\conhost.exe "-20622798491092015224-33046302016872799710022292402123452357-43600594357783770
"C:\Program Files\iPod\bin\iPodService.exe"
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="3068.0.428757786\1076328069" --supports-dual-gpus=false --gpu-driver-bug-workarounds=2,23,51 --disable-accelerated-video-decode --gpu-vendor-id=0x1002 --gpu-device-id=0x9807 --gpu-driver-vendor="ATI Technologies Inc." --gpu-driver-version=8.861.0.0 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AffiliationBasedMatching/EnabledThroughFieldTrial/AppBannerTriggering/Aggressive/AsyncSetAsDefault/EnabledFull/*AutomaticTabDiscarding/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/*ChromeSuggestions/Default/*ClientSideDetectionModel/Model0/*CrossDevicePromo/14DaySingleProfile/*DomRel-Enable/enable/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GFE/Default/InstanceID/Enabled/*IntelligentSessionRestore/Enabled2/*NetworkQualityEstimator/Enabled/*OmniboxBundledExperimentV1/Unused_2/PasswordBranding/Disabled/*PasswordGeneration/Disabled/*QUIC/Disabled/ReportCertificateErrors/ShowAndPossiblySend/*ResourcePriorities/Disabled/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingSocialEngineeringStrings/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes/SafeBrowsingUpdateFrequency/Default/SessionRestoreBackgroundLoading/Restore/SlimmingPaint/EnableSlimmingPaint/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/*VarationsServiceControl/Interval_30min/WebRTC-PeerConnectionDTLS1.2/Enabled/ --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --channel="3068.2.1427069980\1792716636" --font-cache-shared-handle=2532 /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AffiliationBasedMatching/EnabledThroughFieldTrial/AppBannerTriggering/Aggressive/AsyncSetAsDefault/EnabledFull/*AutomaticTabDiscarding/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/*ChromeSuggestions/Default/*ClientSideDetectionModel/Model0/*CrossDevicePromo/14DaySingleProfile/*DomRel-Enable/enable/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GFE/Default/InstanceID/Enabled/*IntelligentSessionRestore/Enabled2/*NetworkQualityEstimator/Enabled/*OmniboxBundledExperimentV1/Unused_2/PasswordBranding/Disabled/*PasswordGeneration/Disabled/*QUIC/Disabled/ReportCertificateErrors/ShowAndPossiblySend/*ResourcePriorities/Disabled/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingSocialEngineeringStrings/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes/SafeBrowsingUpdateFrequency/Default/SessionRestoreBackgroundLoading/Restore/SlimmingPaint/EnableSlimmingPaint/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/*VarationsServiceControl/Interval_30min/WebRTC-PeerConnectionDTLS1.2/Enabled/ --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --channel="3068.3.1829391200\156202932" --font-cache-shared-handle=2608 /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AffiliationBasedMatching/EnabledThroughFieldTrial/AppBannerTriggering/Aggressive/AsyncSetAsDefault/EnabledFull/*AutomaticTabDiscarding/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/*ChromeSuggestions/Default/*ClientSideDetectionModel/Model0/*CrossDevicePromo/14DaySingleProfile/*DomRel-Enable/enable/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GFE/Default/InstanceID/Enabled/*IntelligentSessionRestore/Enabled2/*NetworkQualityEstimator/Enabled/*OmniboxBundledExperimentV1/Unused_2/PasswordBranding/Disabled/*PasswordGeneration/Disabled/*QUIC/Disabled/ReportCertificateErrors/ShowAndPossiblySend/*ResourcePriorities/Disabled/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingSocialEngineeringStrings/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes/SafeBrowsingUpdateFrequency/Default/SessionRestoreBackgroundLoading/Restore/SlimmingPaint/EnableSlimmingPaint/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/*VarationsServiceControl/Interval_30min/WebRTC-PeerConnectionDTLS1.2/Enabled/ --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --channel="3068.4.662286845\572111686" --font-cache-shared-handle=4104 /prefetch:673131151
"C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -auto
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AffiliationBasedMatching/EnabledThroughFieldTrial/AppBannerTriggering/Aggressive/AsyncSetAsDefault/EnabledFull/*AutomaticTabDiscarding/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/*ChromeSuggestions/Default/*ClientSideDetectionModel/Model0/*CrossDevicePromo/14DaySingleProfile/*DomRel-Enable/enable/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GFE/Default/InstanceID/Enabled/*IntelligentSessionRestore/Enabled2/*NetworkQualityEstimator/Enabled/*OmniboxBundledExperimentV1/Unused_2/PasswordBranding/Disabled/*PasswordGeneration/Disabled/*QUIC/Disabled/ReportCertificateErrors/ShowAndPossiblySend/*ResourcePriorities/Disabled/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingSocialEngineeringStrings/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes/*SafeBrowsingUpdateFrequency/Default/SessionRestoreBackgroundLoading/Restore/SlimmingPaint/EnableSlimmingPaint/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/*VarationsServiceControl/Interval_30min/WebRTC-PeerConnectionDTLS1.2/Enabled/ --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --channel="3068.6.537407971\1179867801" --font-cache-shared-handle=1960 /prefetch:673131151
taskeng.exe {099878F5-06C9-49C5-BB7B-B581E10DC385}

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 508 512 520 65536 516
"C:\Users\Mamka\Desktop\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2173376759-2515184244-441396215-1000Core.job - C:\Users\Valča\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2173376759-2515184244-441396215-1000UA.job - C:\Users\Valča\AppData\Local\Facebook\Update\FacebookUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA1cf9139ac547c07.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\Norton Security Scan for Valča.job - C:\PROGRA~2\NORTON~2\Engine\430~1.43\Nss.exe /scan-quick /scheduled

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-01-13 885152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 529664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-10-15 460384]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-01-13 664184]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení k účtu Microsoft - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 441592]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-10-15 172640]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{96A25A24-2E87-4374-8A50-CC6F943FCE4D}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-01-13 2538280]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2012-11-05 108144]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2015-12-17 170256]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"=C:\Users\Valča\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-07-02 138096]
"GoogleChromeAutoLaunch_DD4F918F109122146B27F9FBB40C7B24"=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [2016-01-12 748360]
"cz.seznam.software.autoupdate"=C:\Users\Valča\AppData\Roaming\Seznam.cz\szninstall.exe [2013-05-16 1062472]
"cz.seznam.software.szndesktop"=C:\Users\Valča\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [2015-05-26 103080]
"WebcamMaxAutoRun"=C:\Program Files (x86)\WebcamMax\wcmmon.exe [2011-07-17 1038848]
"Zoner Photo Studio Service 16"=C:\Program Files\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXE [2013-09-16 800280]
"GSplay.exe"=C:\Users\Val8da\Downloads\GSplay\GSplay.exe []
"Zoner Photo Studio Autoupdate"=C:\PROGRAM FILES\ZONER\PHOTO STUDIO 16\Program32\ZPSTRAY.EXE [2013-09-16 800280]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2015-11-30 50509440]
"iCloudServices"=C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [2015-11-30 60688]
"iCloudPhotos"=C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [2015-11-30 349968]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-12-08 8590760]
"ApplePhotoStreams"=C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [2015-11-30 61200]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Application Restart #2"=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [2016-01-12 748360]
"Report"=\AdwCleaner\AdwCleaner[C1].txt [2016-01-23 16182]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-05-24 336384]
"seznam-listicka-distribuce"=C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [2013-05-16 1062472]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2016-01-13 7021880]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-06-08 334896]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce]
"20150107"=C:\Program Files\AVAST Software\Avast\setup\emupdate\fae8e516-c786-45e5-9db9-bac467f677b6.exe [2016-01-22 168336]

C:\Users\Valča\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\Valča\AppData\Roaming\Dropbox\bin\Dropbox.exe
Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk - C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv
"wave3"=wdmaud.drv
"mixer3"=wdmaud.drv
"midi3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"aux2"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux3"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"aux4"=wdmaud.drv
"wave7"=wdmaud.drv
"mixer7"=wdmaud.drv
"midi7"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2016-01-23 18:02:39 ----D---- C:\AdwCleaner
2016-01-23 07:43:42 ----D---- C:\rsit
2016-01-23 07:43:42 ----D---- C:\Program Files\trend micro
2016-01-19 20:05:07 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe
2016-01-15 07:03:42 ----D---- C:\ProgramData\Package Cache
2016-01-13 08:05:17 ----A---- C:\Windows\SYSWOW64\mapistub.dll
2016-01-13 08:05:17 ----A---- C:\Windows\SYSWOW64\mapi32.dll
2016-01-13 08:05:17 ----A---- C:\Windows\SYSWOW64\fixmapi.exe
2016-01-13 08:05:17 ----A---- C:\Windows\system32\mapistub.dll
2016-01-13 08:05:17 ----A---- C:\Windows\system32\mapi32.dll
2016-01-13 08:05:17 ----A---- C:\Windows\system32\fixmapi.exe
2016-01-13 08:05:17 ----A---- C:\Windows\system32\aeinv.dll
2016-01-13 08:05:16 ----A---- C:\Windows\system32\qedit.dll
2016-01-13 08:05:15 ----A---- C:\Windows\SYSWOW64\qedit.dll
2016-01-13 08:05:13 ----A---- C:\Windows\system32\WMVDECOD.DLL
2016-01-13 08:05:13 ----A---- C:\Windows\system32\WMADMOD.DLL
2016-01-13 08:05:13 ----A---- C:\Windows\system32\msmpeg2adec.dll
2016-01-13 08:05:12 ----A---- C:\Windows\SYSWOW64\WMVDECOD.DLL
2016-01-13 08:05:12 ----A---- C:\Windows\SYSWOW64\msmpeg2adec.dll
2016-01-13 08:05:12 ----A---- C:\Windows\system32\WMSPDMOD.DLL
2016-01-13 08:05:11 ----A---- C:\Windows\SYSWOW64\WMADMOD.DLL
2016-01-13 08:05:11 ----A---- C:\Windows\system32\WMVSDECD.DLL
2016-01-13 08:05:11 ----A---- C:\Windows\system32\MSMPEG2ENC.DLL
2016-01-13 08:05:11 ----A---- C:\Windows\system32\mf.dll
2016-01-13 08:05:10 ----A---- C:\Windows\SYSWOW64\MSMPEG2ENC.DLL
2016-01-13 08:05:09 ----A---- C:\Windows\SYSWOW64\WMVSDECD.DLL
2016-01-13 08:05:09 ----A---- C:\Windows\SYSWOW64\WMSPDMOD.DLL
2016-01-13 08:05:09 ----A---- C:\Windows\SYSWOW64\mf.dll
2016-01-13 08:05:09 ----A---- C:\Windows\system32\WMADMOE.DLL
2016-01-13 08:05:08 ----A---- C:\Windows\SYSWOW64\WMADMOE.DLL
2016-01-13 08:05:08 ----A---- C:\Windows\system32\mcmde.dll
2016-01-13 08:05:07 ----A---- C:\Windows\SYSWOW64\WMVENCOD.DLL
2016-01-13 08:05:07 ----A---- C:\Windows\SYSWOW64\wmpmde.dll
2016-01-13 08:05:07 ----A---- C:\Windows\SYSWOW64\COLORCNV.DLL
2016-01-13 08:05:07 ----A---- C:\Windows\system32\WMVENCOD.DLL
2016-01-13 08:05:07 ----A---- C:\Windows\system32\wmpmde.dll
2016-01-13 08:05:07 ----A---- C:\Windows\system32\quartz.dll
2016-01-13 08:05:07 ----A---- C:\Windows\system32\evr.dll
2016-01-13 08:05:07 ----A---- C:\Windows\system32\COLORCNV.DLL
2016-01-13 08:05:06 ----A---- C:\Windows\SYSWOW64\WMVXENCD.DLL
2016-01-13 08:05:06 ----A---- C:\Windows\SYSWOW64\quartz.dll
2016-01-13 08:05:06 ----A---- C:\Windows\SYSWOW64\evr.dll
2016-01-13 08:05:06 ----A---- C:\Windows\system32\WMVXENCD.DLL
2016-01-13 08:05:06 ----A---- C:\Windows\system32\WMSPDMOE.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\SYSWOW64\qdvd.dll
2016-01-13 08:05:05 ----A---- C:\Windows\SYSWOW64\mfplat.dll
2016-01-13 08:05:05 ----A---- C:\Windows\SYSWOW64\devenum.dll
2016-01-13 08:05:05 ----A---- C:\Windows\system32\WMVSENCD.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\VIDRESZR.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\MPG4DECD.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\MP4SDECD.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\MP43DECD.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\MFWMAAEC.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\mfplat.dll
2016-01-13 08:05:05 ----A---- C:\Windows\system32\devenum.dll
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\WMVSENCD.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\WMSPDMOE.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\qasf.dll
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\msmpeg2vdec.dll
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\MPG4DECD.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\MP43DECD.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\MFWMAAEC.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\system32\RESAMPLEDMO.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\system32\qdvd.dll
2016-01-13 08:05:04 ----A---- C:\Windows\system32\MP3DMOD.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\system32\mfvdsp.dll
2016-01-13 08:05:03 ----A---- C:\Windows\SYSWOW64\VIDRESZR.DLL
2016-01-13 08:05:03 ----A---- C:\Windows\SYSWOW64\RESAMPLEDMO.DLL
2016-01-13 08:05:03 ----A---- C:\Windows\SYSWOW64\MP4SDECD.DLL
2016-01-13 08:05:03 ----A---- C:\Windows\SYSWOW64\MP3DMOD.DLL
2016-01-13 08:05:03 ----A---- C:\Windows\system32\SysFxUI.dll
2016-01-13 08:05:03 ----A---- C:\Windows\system32\qasf.dll
2016-01-13 08:05:03 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2016-01-13 08:05:02 ----A---- C:\Windows\SYSWOW64\rrinstaller.exe
2016-01-13 08:05:02 ----A---- C:\Windows\SYSWOW64\mfvdsp.dll
2016-01-13 08:05:02 ----A---- C:\Windows\SYSWOW64\mfps.dll
2016-01-13 08:05:02 ----A---- C:\Windows\SYSWOW64\mfpmp.exe
2016-01-13 08:05:02 ----A---- C:\Windows\system32\rrinstaller.exe
2016-01-13 08:05:02 ----A---- C:\Windows\system32\mfps.dll
2016-01-13 08:05:02 ----A---- C:\Windows\system32\mfpmp.exe
2016-01-13 08:05:02 ----A---- C:\Windows\system32\drivers\portcls.sys
2016-01-13 08:05:00 ----A---- C:\Windows\SYSWOW64\mferror.dll
2016-01-13 08:05:00 ----A---- C:\Windows\SYSWOW64\ksuser.dll
2016-01-13 08:05:00 ----A---- C:\Windows\system32\mferror.dll
2016-01-13 08:05:00 ----A---- C:\Windows\system32\ksuser.dll
2016-01-13 08:05:00 ----A---- C:\Windows\system32\drivers\drmkaud.sys
2016-01-13 08:05:00 ----A---- C:\Windows\system32\drivers\drmk.sys
2016-01-13 08:04:57 ----A---- C:\Windows\system32\win32k.sys
2016-01-13 08:04:49 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2016-01-13 08:04:49 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2016-01-13 08:04:49 ----A---- C:\Windows\system32\iertutil.dll
2016-01-13 08:04:49 ----A---- C:\Windows\system32\ieetwcollector.exe
2016-01-13 08:04:48 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2016-01-13 08:04:48 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2016-01-13 08:04:48 ----A---- C:\Windows\system32\ieetwproxystub.dll
2016-01-13 08:04:47 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\occache.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2016-01-13 08:04:46 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-01-13 08:04:46 ----A---- C:\Windows\system32\iernonce.dll
2016-01-13 08:04:46 ----A---- C:\Windows\system32\ie4uinit.exe
2016-01-13 08:04:45 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2016-01-13 08:04:45 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2016-01-13 08:04:42 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2016-01-13 08:04:42 ----A---- C:\Windows\SYSWOW64\jscript.dll
2016-01-13 08:04:42 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2016-01-13 08:04:42 ----A---- C:\Windows\system32\urlmon.dll
2016-01-13 08:04:42 ----A---- C:\Windows\system32\occache.dll
2016-01-13 08:04:42 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2016-01-13 08:04:42 ----A---- C:\Windows\system32\iedkcs32.dll
2016-01-13 08:04:41 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2016-01-13 08:04:41 ----A---- C:\Windows\SYSWOW64\ieui.dll
2016-01-13 08:04:41 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2016-01-13 08:04:41 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2016-01-13 08:04:41 ----A---- C:\Windows\system32\msfeeds.dll
2016-01-13 08:04:41 ----A---- C:\Windows\system32\dxtrans.dll
2016-01-13 08:04:40 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2016-01-13 08:04:39 ----A---- C:\Windows\system32\iesetup.dll
2016-01-13 08:04:37 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2016-01-13 08:04:37 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2016-01-13 08:04:36 ----A---- C:\Windows\SYSWOW64\wininet.dll
2016-01-13 08:04:36 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2016-01-13 08:04:36 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2016-01-13 08:04:36 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2016-01-13 08:04:36 ----A---- C:\Windows\system32\vbscript.dll
2016-01-13 08:04:35 ----A---- C:\Windows\SYSWOW64\msrating.dll
2016-01-13 08:04:35 ----A---- C:\Windows\system32\jsproxy.dll
2016-01-13 08:04:34 ----A---- C:\Windows\system32\ieui.dll
2016-01-13 08:04:34 ----A---- C:\Windows\system32\dxtmsft.dll
2016-01-13 08:04:33 ----A---- C:\Windows\system32\ieframe.dll
2016-01-13 08:04:32 ----A---- C:\Windows\system32\mshtmlmedia.dll
2016-01-13 08:04:32 ----A---- C:\Windows\system32\mshtmled.dll
2016-01-13 08:04:31 ----A---- C:\Windows\system32\webcheck.dll
2016-01-13 08:04:31 ----A---- C:\Windows\system32\jscript.dll
2016-01-13 08:04:31 ----A---- C:\Windows\system32\ieUnatt.exe
2016-01-13 08:04:30 ----A---- C:\Windows\system32\jscript9diag.dll
2016-01-13 08:04:30 ----A---- C:\Windows\system32\jscript9.dll
2016-01-13 08:04:29 ----A---- C:\Windows\system32\wininet.dll
2016-01-13 08:04:29 ----A---- C:\Windows\system32\ieapfltr.dll
2016-01-13 08:04:27 ----A---- C:\Windows\system32\msrating.dll
2016-01-13 08:04:27 ----A---- C:\Windows\system32\MshtmlDac.dll
2016-01-13 08:04:26 ----A---- C:\Windows\system32\mshtml.dll
2016-01-13 08:03:50 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2016-01-13 08:03:50 ----A---- C:\Windows\system32\advapi32.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\invagent.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\generaltel.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\devinv.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\CompatTelRunner.exe
2016-01-13 08:03:48 ----A---- C:\Windows\system32\appraiser.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\aepic.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\acmigration.dll
2016-01-13 08:03:46 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2016-01-13 08:03:46 ----A---- C:\Windows\system32\gdi32.dll
2016-01-13 08:03:37 ----A---- C:\Windows\system32\rpcrt4.dll
2016-01-13 08:03:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2016-01-13 08:03:35 ----A---- C:\Windows\system32\schannel.dll
2016-01-13 08:03:35 ----A---- C:\Windows\system32\kerberos.dll
2016-01-13 08:03:34 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2016-01-13 08:03:33 ----A---- C:\Windows\SYSWOW64\schannel.dll
2016-01-13 08:03:33 ----A---- C:\Windows\system32\lsasrv.dll
2016-01-13 08:03:32 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2016-01-13 08:03:32 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2016-01-13 08:03:32 ----A---- C:\Windows\system32\ncrypt.dll
2016-01-13 08:03:31 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2016-01-13 08:03:31 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2016-01-13 08:03:31 ----A---- C:\Windows\system32\TSpkg.dll
2016-01-13 08:03:31 ----A---- C:\Windows\system32\msv1_0.dll
2016-01-13 08:03:31 ----A---- C:\Windows\system32\kernel32.dll
2016-01-13 08:03:31 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2016-01-13 08:03:30 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2016-01-13 08:03:30 ----A---- C:\Windows\system32\wdigest.dll
2016-01-13 08:03:29 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2016-01-13 08:03:29 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2016-01-13 08:03:29 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2016-01-13 08:03:29 ----A---- C:\Windows\system32\ntdll.dll
2016-01-13 08:03:29 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2016-01-13 08:03:28 ----A---- C:\Windows\SYSWOW64\credssp.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\winsrv.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\sspicli.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\secur32.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\cryptbase.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\credssp.dll
2016-01-13 08:03:27 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2016-01-13 08:03:27 ----A---- C:\Windows\SYSWOW64\secur32.dll
2016-01-13 08:03:27 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2016-01-13 08:03:27 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2016-01-13 08:03:27 ----A---- C:\Windows\system32\sspisrv.dll
2016-01-13 08:03:27 ----A---- C:\Windows\system32\smss.exe
2016-01-13 08:03:27 ----A---- C:\Windows\system32\ntvdm64.dll
2016-01-13 08:03:27 ----A---- C:\Windows\system32\lsass.exe
2016-01-13 08:03:27 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2016-01-13 08:03:27 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2016-01-13 08:03:26 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\wow64win.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\wow64.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\srcore.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\KernelBase.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2016-01-13 08:03:26 ----A---- C:\Windows\system32\conhost.exe
2016-01-13 08:03:25 ----A---- C:\Windows\SYSWOW64\srclient.dll
2016-01-13 08:03:25 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2016-01-13 08:03:25 ----A---- C:\Windows\system32\wow64cpu.dll
2016-01-13 08:03:25 ----A---- C:\Windows\system32\srclient.dll
2016-01-13 08:03:25 ----A---- C:\Windows\system32\rstrui.exe
2016-01-13 08:03:25 ----A---- C:\Windows\system32\csrsrv.dll
2016-01-13 08:03:25 ----A---- C:\Windows\system32\auditpol.exe
2016-01-13 08:03:24 ----A---- C:\Windows\SYSWOW64\wow32.dll
2016-01-13 08:03:24 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2016-01-13 08:03:24 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2016-01-13 08:03:24 ----A---- C:\Windows\system32\apisetschema.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-01-13 08:03:23 ----A---- C:\Windows\SYSWOW64\instnm.exe
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-01-13 08:03:22 ----A---- C:\Windows\SYSWOW64\setup16.exe
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-01-13 08:03:20 ----A---- C:\Windows\SYSWOW64\user.exe
2016-01-13 08:03:20 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2016-01-13 08:03:20 ----A---- C:\Windows\system32\adtschema.dll
2016-01-13 08:03:19 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2016-01-13 08:03:19 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2016-01-13 08:03:19 ----A---- C:\Windows\system32\msobjs.dll
2016-01-13 08:03:19 ----A---- C:\Windows\system32\msaudite.dll
2016-01-13 06:36:32 ----A---- C:\Windows\system32\aswBoot.exe
2016-01-13 06:36:15 ----A---- C:\Windows\avastSS.scr
2016-01-08 20:40:01 ----D---- C:\Program Files\CCleaner
2016-01-08 20:04:43 ----A---- C:\Windows\system32\drivers\mwac.sys
2016-01-08 20:04:43 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2016-01-08 20:04:42 ----D---- C:\ProgramData\Malwarebytes
2016-01-08 20:04:42 ----A---- C:\Windows\system32\drivers\mbam.sys
2015-12-24 18:36:07 ----D---- C:\Program Files (x86)\iTunes
2015-12-24 18:36:06 ----D---- C:\Program Files\iPod
2015-12-24 18:36:01 ----D---- C:\Program Files\iTunes
2015-12-24 18:16:55 ----D---- C:\Program Files\Common Files\Apple

======List of files/folders modified in the last 1 month======

2016-01-23 18:37:49 ----D---- C:\Windows\Temp
2016-01-23 18:28:21 ----D---- C:\Windows\system32\config
2016-01-23 18:27:53 ----D---- C:\Windows\Prefetch
2016-01-23 18:11:56 ----D---- C:\Windows\system32\drivers
2016-01-23 18:09:35 ----HD---- C:\ProgramData
2016-01-23 18:09:33 ----RD---- C:\Program Files (x86)
2016-01-23 18:09:33 ----D---- C:\Program Files (x86)\Common Files
2016-01-23 18:02:38 ----D---- C:\Windows\System32
2016-01-23 18:02:38 ----D---- C:\Windows\inf
2016-01-23 18:02:38 ----A---- C:\Windows\system32\PerfStringBackup.INI
2016-01-23 11:52:18 ----SHD---- C:\System Volume Information
2016-01-23 07:43:42 ----RD---- C:\Program Files
2016-01-19 20:05:25 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2016-01-19 20:05:07 ----D---- C:\Windows\SysWOW64
2016-01-18 14:15:23 ----D---- C:\Windows\tracing
2016-01-17 17:02:08 ----D---- C:\Users\Valča\AppData\Roaming\Seznam.cz
2016-01-17 16:58:58 ----D---- C:\Users\Valča\AppData\Roaming\Skype
2016-01-17 16:58:21 ----D---- C:\Users\Valča\AppData\Roaming\Dropbox
2016-01-17 16:58:13 ----D---- C:\Users\Valča\AppData\Roaming\DropboxMaster
2016-01-16 20:37:45 ----D---- C:\Windows\rescache
2016-01-16 07:38:37 ----D---- C:\Windows\winsxs
2016-01-16 07:36:41 ----D---- C:\Windows\SYSWOW64\cs-CZ
2016-01-16 07:36:40 ----D---- C:\Windows\system32\cs-CZ
2016-01-16 07:36:39 ----D---- C:\Windows\AppPatch
2016-01-16 07:21:03 ----SHD---- C:\Windows\Installer
2016-01-16 07:21:03 ----SHD---- C:\Config.Msi
2016-01-15 07:50:31 ----D---- C:\Program Files\Microsoft Silverlight
2016-01-15 07:50:30 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2016-01-15 07:48:49 ----D---- C:\Windows\SYSWOW64\en-US
2016-01-15 07:48:49 ----D---- C:\Program Files\Internet Explorer
2016-01-15 07:48:48 ----D---- C:\Windows\system32\en-US
2016-01-15 07:48:47 ----D---- C:\Program Files (x86)\Internet Explorer
2016-01-15 07:48:46 ----SD---- C:\Windows\system32\CompatTel
2016-01-15 07:48:46 ----D---- C:\Windows\system32\appraiser
2016-01-15 07:48:44 ----D---- C:\Windows\system32\DriverStore
2016-01-15 07:47:37 ----D---- C:\ProgramData\Microsoft Help
2016-01-15 07:40:46 ----A---- C:\Windows\win.ini
2016-01-15 07:20:38 ----D---- C:\Windows\system32\MRT
2016-01-15 07:20:37 ----D---- C:\Windows\debug
2016-01-15 07:20:28 ----A---- C:\Windows\system32\MRT.exe
2016-01-13 07:59:57 ----D---- C:\Windows\system32\catroot2
2016-01-13 06:36:49 ----D---- C:\Windows\system32\Tasks
2016-01-13 06:36:30 ----D---- C:\Windows
2016-01-08 20:45:05 ----D---- C:\Users\Valča\AppData\Roaming\DAEMON Tools Lite
2016-01-08 20:44:31 ----D---- C:\Windows\ModemLogs
2016-01-08 20:44:29 ----D---- C:\Windows\Minidump
2016-01-08 20:44:29 ----D---- C:\Windows\Logs
2015-12-26 10:45:47 ----D---- C:\Users\Valča\AppData\Roaming\Apple Computer
2015-12-25 14:07:59 ----D---- C:\Windows\Microsoft.NET
2015-12-24 18:36:01 ----D---- C:\ProgramData\Apple Computer
2015-12-24 18:19:37 ----D---- C:\Program Files (x86)\Apple Software Update
2015-12-24 18:19:21 ----D---- C:\ProgramData\Apple
2015-12-24 18:19:09 ----D---- C:\Windows\system32\catroot
2015-12-24 18:18:08 ----D---- C:\Program Files\Bonjour
2015-12-24 18:18:08 ----D---- C:\Program Files (x86)\Bonjour
2015-12-24 18:16:55 ----D---- C:\Program Files\Common Files
2015-12-24 07:16:42 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2016-01-13 65224]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2016-01-13 273784]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2016-01-13 93528]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2016-01-21 1065208]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2016-01-21 464256]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [2015-09-24 498512]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2016-01-13 28656]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2016-01-13 97648]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2016-01-13 155304]
R2 WCMVCAM;WebcamMax, WDM Video Capture; C:\Windows\system32\DRIVERS\wcmvcam64.sys [2012-04-15 1071032]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-05-24 9359872]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-05-24 309760]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-04-29 2727424]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2011-03-30 114704]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2011-03-25 1583744]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2011-01-25 77424]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-01-13 1412144]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2010-11-28 44672]
S3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys []
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys []
S3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys []
S3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys []
S3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys []
S3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys []
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device; C:\Windows\system32\DRIVERS\ew_hwusbdev.sys []
S3 ew_usbenumfilter;huawei_CompositeFilter; C:\Windows\system32\DRIVERS\ew_usbenumfilter.sys []
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2014-03-31 58056]
S3 huawei_cdcacm;huawei_cdcacm; C:\Windows\system32\DRIVERS\ew_jucdcacm.sys []
S3 huawei_enumerator;huawei_enumerator; C:\Windows\system32\DRIVERS\ew_jubusenum.sys []
S3 huawei_ext_ctrl;huawei_ext_ctrl; C:\Windows\system32\DRIVERS\ew_juextctrl.sys []
S3 huawei_wwanecm;huawei_wwanecm; C:\Windows\system32\DRIVERS\ew_juwwanecm.sys []
S3 netr28ux;RT2870 USB Wireless LAN Card Driver pro systém Windows Vista; C:\Windows\system32\DRIVERS\netr28ux.sys [2009-06-10 867328]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2013-02-19 19456]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-12-01 250984]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [2010-11-21 88960]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2013-02-19 29696]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-02-19 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2013-02-19 30208]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2015-06-17 54784]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-10-09 42496]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-12-13 82128]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-05-24 204288]
R2 Apple Mobile Device Service;Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2015-10-07 77104]
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2016-01-13 226440]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2015-08-12 462096]
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2010-12-17 198784]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2012-07-17 2292480]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2015-12-17 644880]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-07-09 327296]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-01-19 269504]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2014-03-31 1512640]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-12-12 114688]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2013-12-19 50942144]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-04-21 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]

-----------------EOF-----------------

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:

:files
C:\Users\Valča\AppData\Local\Facebook\Update
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2173376759-2515184244-441396215-1000Core.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2173376759-2515184244-441396215-1000UA.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA1cf9139ac547c07.job

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]/64
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"=-
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-

:commands
[Purity]
[Emptytemp]
[Emptyflash]

a klikněte na >MoveIt!<. Před skenem vypněte antivir a po něm restartujte PC. Dejte nový log RSIT.

Logfile of random's system information tool 1.10 (written by random/random)
Run by Valča at 2016-01-24 09:14:03
Microsoft Windows 7 Enterprise Service Pack 1
System drive C: has 4 GB (4%) free of 100 GB
Total RAM: 3819 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:14:14, on 24.1.2016
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18163)
Boot mode: Normal

Running processes:
C:\Users\Mamka\AppData\Roaming\Seznam.cz\szninstall.exe
C:\Users\Mamka\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Valča.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.seznam.cz/?sourceid=quick ... earchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.seznam.cz/?sourceid=quick ... earchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\RunOnce: [20150107] C:\Program Files\AVAST Software\Avast\setup\emupdate\fae8e516-c786-45e5-9db9-bac467f677b6.exe /check
O4 - HKLM\..\RunOnce: [OTM] "C:\Users\Mamka\Desktop\OTM.exe"
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_DD4F918F109122146B27F9FBB40C7B24] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
O4 - HKCU\..\Run: [cz.seznam.software.autoupdate] "C:\Users\Valča\AppData\Roaming\Seznam.cz\szninstall.exe" -c
O4 - HKCU\..\Run: [cz.seznam.software.szndesktop] "C:\Users\Valča\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
O4 - HKCU\..\Run: [WebcamMaxAutoRun] "C:\Program Files (x86)\WebcamMax\wcmmon.exe" -a
O4 - HKCU\..\Run: [Zoner Photo Studio Service 16] "C:\Program Files\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXEC:\Program Files\Zoner\Photo Studio 16\Program32\ZPSService.exe"
O4 - HKCU\..\Run: [GSplay.exe] C:\Users\Val%c4%8da\Downloads\GSplay\GSplay.exe
O4 - HKCU\..\Run: [Zoner Photo Studio Autoupdate] "C:\PROGRAM FILES\ZONER\PHOTO STUDIO 16\Program32\ZPSTRAY.EXE"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
O4 - HKCU\..\Run: [iCloudPhotos] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
O4 - HKCU\..\RunOnce: [Application Restart #2] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --flag-switches-begin --flag-switches-end --restore-last-session http://www.qvo6.com/?utm_source=b&utm_m ... 1383924642
O4 - HKCU\..\RunOnce: [Report] \AdwCleaner\AdwCleaner[C1].txt
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2173376759-2515184244-441396215-1001\..\Run: [cz.seznam.software.szndesktop] "C:\Users\Mamka\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q (User 'Mamka')
O4 - HKUS\S-1-5-18\..\Run: [Advanced SystemCare 6] "C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCTray.exe" /AutoStart (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe -update activex (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Advanced SystemCare 6] "C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCTray.exe" /AutoStart (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe -update activex (User 'Default user')
O4 - Startup: Dropbox.lnk = ?
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{445395C6-054D-4288-AB24-31F58281FF7C}: NameServer = 62.129.50.20,62.129.32.100
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Users\VALA~1\AppData\Local\DProtect\eBP.dll,C:\Users\VALA~1\AppData\Local\DProtect\eBPSD.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device Service - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12706 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\Windows\System32\spoolsv.exe
taskeng.exe {F16A3B65-CD32-4961-8AB9-544A99F2AC3E}
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
"C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Windows\system32\CxAudMsg64.exe
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 772
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\iTunes\iTunesHelper.exe"
"C:\Users\Mamka\AppData\Roaming\Seznam.cz\szninstall.exe" -c
"C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
szndesktop.exe default start
"C:\Users\Mamka\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
\??\C:\Windows\system32\conhost.exe "-148000355-837679571339102568552281216-1479287698-2576003891307508481903154495
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
"C:\Program Files\iPod\bin\iPodService.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="3080.0.2131793045\1770026036" --supports-dual-gpus=false --gpu-driver-bug-workarounds=2,23,51 --disable-accelerated-video-decode --gpu-vendor-id=0x1002 --gpu-device-id=0x9807 --gpu-driver-vendor="ATI Technologies Inc." --gpu-driver-version=8.861.0.0 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AffiliationBasedMatching/EnabledThroughFieldTrial/AppBannerTriggering/Aggressive/AsyncSetAsDefault/EnabledFull/*AutomaticTabDiscarding/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/*ChromeSuggestions/Default/*ClientSideDetectionModel/Model0/*CrossDevicePromo/14DaySingleProfile/*DomRel-Enable/enable/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GFE/Default/InstanceID/Enabled/*IntelligentSessionRestore/Enabled2/*NetworkQualityEstimator/Enabled/*OmniboxBundledExperimentV1/Unused_2/PasswordBranding/Disabled/*PasswordGeneration/Disabled/*QUIC/Disabled/ReportCertificateErrors/ShowAndPossiblySend/*ResourcePriorities/Disabled/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingSocialEngineeringStrings/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes/SafeBrowsingUpdateFrequency/Default/SessionRestoreBackgroundLoading/Restore/SlimmingPaint/EnableSlimmingPaint/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/*VarationsServiceControl/Interval_30min/WebRTC-PeerConnectionDTLS1.2/Enabled/ --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --channel="3080.2.1676198217\2076334104" --font-cache-shared-handle=2220 /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AffiliationBasedMatching/EnabledThroughFieldTrial/AppBannerTriggering/Aggressive/AsyncSetAsDefault/EnabledFull/*AutomaticTabDiscarding/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/*ChromeSuggestions/Default/*ClientSideDetectionModel/Model0/*CrossDevicePromo/14DaySingleProfile/*DomRel-Enable/enable/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GFE/Default/InstanceID/Enabled/*IntelligentSessionRestore/Enabled2/*NetworkQualityEstimator/Enabled/*OmniboxBundledExperimentV1/Unused_2/PasswordBranding/Disabled/*PasswordGeneration/Disabled/*QUIC/Disabled/ReportCertificateErrors/ShowAndPossiblySend/*ResourcePriorities/Disabled/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingSocialEngineeringStrings/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes/SafeBrowsingUpdateFrequency/Default/SessionRestoreBackgroundLoading/Restore/SlimmingPaint/EnableSlimmingPaint/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/*VarationsServiceControl/Interval_30min/WebRTC-PeerConnectionDTLS1.2/Enabled/ --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --channel="3080.3.1386799697\925113663" --font-cache-shared-handle=2256 /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AffiliationBasedMatching/EnabledThroughFieldTrial/AppBannerTriggering/Aggressive/AsyncSetAsDefault/EnabledFull/*AutomaticTabDiscarding/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/*ChromeSuggestions/Default/*ClientSideDetectionModel/Model0/*CrossDevicePromo/14DaySingleProfile/*DomRel-Enable/enable/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GFE/Default/InstanceID/Enabled/*IntelligentSessionRestore/Enabled2/*NetworkQualityEstimator/Enabled/*OmniboxBundledExperimentV1/Unused_2/PasswordBranding/Disabled/*PasswordGeneration/Disabled/*QUIC/Disabled/ReportCertificateErrors/ShowAndPossiblySend/*ResourcePriorities/Disabled/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingSocialEngineeringStrings/Enabled/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes/SafeBrowsingUpdateFrequency/Default/SessionRestoreBackgroundLoading/Restore/SlimmingPaint/EnableSlimmingPaint/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/*VarationsServiceControl/Interval_30min/WebRTC-PeerConnectionDTLS1.2/Enabled/ --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --channel="3080.4.921063262\1936721809" --font-cache-shared-handle=3944 /prefetch:673131151
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 508 512 520 65536 516
"C:\Users\Mamka\Desktop\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\Norton Security Scan for Valča.job - C:\PROGRA~2\NORTON~2\Engine\430~1.43\Nss.exe /scan-quick /scheduled

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-01-13 885152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 529664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-10-15 460384]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-01-13 664184]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení k účtu Microsoft - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 441592]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-10-15 172640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-01-13 2538280]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2012-11-05 108144]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2015-12-17 170256]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"GoogleChromeAutoLaunch_DD4F918F109122146B27F9FBB40C7B24"=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [2016-01-12 748360]
"cz.seznam.software.autoupdate"=C:\Users\Valča\AppData\Roaming\Seznam.cz\szninstall.exe [2013-05-16 1062472]
"cz.seznam.software.szndesktop"=C:\Users\Valča\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [2015-05-26 103080]
"WebcamMaxAutoRun"=C:\Program Files (x86)\WebcamMax\wcmmon.exe [2011-07-17 1038848]
"Zoner Photo Studio Service 16"=C:\Program Files\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXE [2013-09-16 800280]
"GSplay.exe"=C:\Users\Val8da\Downloads\GSplay\GSplay.exe []
"Zoner Photo Studio Autoupdate"=C:\PROGRAM FILES\ZONER\PHOTO STUDIO 16\Program32\ZPSTRAY.EXE [2013-09-16 800280]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2015-11-30 50509440]
"iCloudServices"=C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [2015-11-30 60688]
"iCloudPhotos"=C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [2015-11-30 349968]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-12-08 8590760]
"ApplePhotoStreams"=C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [2015-11-30 61200]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Application Restart #2"=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [2016-01-12 748360]
"Report"=\AdwCleaner\AdwCleaner[C1].txt [2016-01-23 16182]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-05-24 336384]
"seznam-listicka-distribuce"=C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [2013-05-16 1062472]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2016-01-13 7021880]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce]
"20150107"=C:\Program Files\AVAST Software\Avast\setup\emupdate\fae8e516-c786-45e5-9db9-bac467f677b6.exe [2016-01-22 168336]
"OTM"=C:\Users\Mamka\Desktop\OTM.exe [2016-01-24 522240]

C:\Users\Valča\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\Valča\AppData\Roaming\Dropbox\bin\Dropbox.exe
Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk - C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv
"wave3"=wdmaud.drv
"mixer3"=wdmaud.drv
"midi3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"aux2"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux3"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"aux4"=wdmaud.drv
"wave7"=wdmaud.drv
"mixer7"=wdmaud.drv
"midi7"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2016-01-24 09:08:05 ----D---- C:\_OTM
2016-01-23 18:02:39 ----D---- C:\AdwCleaner
2016-01-23 07:43:42 ----D---- C:\rsit
2016-01-23 07:43:42 ----D---- C:\Program Files\trend micro
2016-01-19 20:05:07 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe
2016-01-15 07:03:42 ----D---- C:\ProgramData\Package Cache
2016-01-13 08:05:17 ----A---- C:\Windows\SYSWOW64\mapistub.dll
2016-01-13 08:05:17 ----A---- C:\Windows\SYSWOW64\mapi32.dll
2016-01-13 08:05:17 ----A---- C:\Windows\SYSWOW64\fixmapi.exe
2016-01-13 08:05:17 ----A---- C:\Windows\system32\mapistub.dll
2016-01-13 08:05:17 ----A---- C:\Windows\system32\mapi32.dll
2016-01-13 08:05:17 ----A---- C:\Windows\system32\fixmapi.exe
2016-01-13 08:05:17 ----A---- C:\Windows\system32\aeinv.dll
2016-01-13 08:05:16 ----A---- C:\Windows\system32\qedit.dll
2016-01-13 08:05:15 ----A---- C:\Windows\SYSWOW64\qedit.dll
2016-01-13 08:05:13 ----A---- C:\Windows\system32\WMVDECOD.DLL
2016-01-13 08:05:13 ----A---- C:\Windows\system32\WMADMOD.DLL
2016-01-13 08:05:13 ----A---- C:\Windows\system32\msmpeg2adec.dll
2016-01-13 08:05:12 ----A---- C:\Windows\SYSWOW64\WMVDECOD.DLL
2016-01-13 08:05:12 ----A---- C:\Windows\SYSWOW64\msmpeg2adec.dll
2016-01-13 08:05:12 ----A---- C:\Windows\system32\WMSPDMOD.DLL
2016-01-13 08:05:11 ----A---- C:\Windows\SYSWOW64\WMADMOD.DLL
2016-01-13 08:05:11 ----A---- C:\Windows\system32\WMVSDECD.DLL
2016-01-13 08:05:11 ----A---- C:\Windows\system32\MSMPEG2ENC.DLL
2016-01-13 08:05:11 ----A---- C:\Windows\system32\mf.dll
2016-01-13 08:05:10 ----A---- C:\Windows\SYSWOW64\MSMPEG2ENC.DLL
2016-01-13 08:05:09 ----A---- C:\Windows\SYSWOW64\WMVSDECD.DLL
2016-01-13 08:05:09 ----A---- C:\Windows\SYSWOW64\WMSPDMOD.DLL
2016-01-13 08:05:09 ----A---- C:\Windows\SYSWOW64\mf.dll
2016-01-13 08:05:09 ----A---- C:\Windows\system32\WMADMOE.DLL
2016-01-13 08:05:08 ----A---- C:\Windows\SYSWOW64\WMADMOE.DLL
2016-01-13 08:05:08 ----A---- C:\Windows\system32\mcmde.dll
2016-01-13 08:05:07 ----A---- C:\Windows\SYSWOW64\WMVENCOD.DLL
2016-01-13 08:05:07 ----A---- C:\Windows\SYSWOW64\wmpmde.dll
2016-01-13 08:05:07 ----A---- C:\Windows\SYSWOW64\COLORCNV.DLL
2016-01-13 08:05:07 ----A---- C:\Windows\system32\WMVENCOD.DLL
2016-01-13 08:05:07 ----A---- C:\Windows\system32\wmpmde.dll
2016-01-13 08:05:07 ----A---- C:\Windows\system32\quartz.dll
2016-01-13 08:05:07 ----A---- C:\Windows\system32\evr.dll
2016-01-13 08:05:07 ----A---- C:\Windows\system32\COLORCNV.DLL
2016-01-13 08:05:06 ----A---- C:\Windows\SYSWOW64\WMVXENCD.DLL
2016-01-13 08:05:06 ----A---- C:\Windows\SYSWOW64\quartz.dll
2016-01-13 08:05:06 ----A---- C:\Windows\SYSWOW64\evr.dll
2016-01-13 08:05:06 ----A---- C:\Windows\system32\WMVXENCD.DLL
2016-01-13 08:05:06 ----A---- C:\Windows\system32\WMSPDMOE.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\SYSWOW64\qdvd.dll
2016-01-13 08:05:05 ----A---- C:\Windows\SYSWOW64\mfplat.dll
2016-01-13 08:05:05 ----A---- C:\Windows\SYSWOW64\devenum.dll
2016-01-13 08:05:05 ----A---- C:\Windows\system32\WMVSENCD.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\VIDRESZR.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\MPG4DECD.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\MP4SDECD.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\MP43DECD.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\MFWMAAEC.DLL
2016-01-13 08:05:05 ----A---- C:\Windows\system32\mfplat.dll
2016-01-13 08:05:05 ----A---- C:\Windows\system32\devenum.dll
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\WMVSENCD.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\WMSPDMOE.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\qasf.dll
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\msmpeg2vdec.dll
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\MPG4DECD.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\MP43DECD.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\SYSWOW64\MFWMAAEC.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\system32\RESAMPLEDMO.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\system32\qdvd.dll
2016-01-13 08:05:04 ----A---- C:\Windows\system32\MP3DMOD.DLL
2016-01-13 08:05:04 ----A---- C:\Windows\system32\mfvdsp.dll
2016-01-13 08:05:03 ----A---- C:\Windows\SYSWOW64\VIDRESZR.DLL
2016-01-13 08:05:03 ----A---- C:\Windows\SYSWOW64\RESAMPLEDMO.DLL
2016-01-13 08:05:03 ----A---- C:\Windows\SYSWOW64\MP4SDECD.DLL
2016-01-13 08:05:03 ----A---- C:\Windows\SYSWOW64\MP3DMOD.DLL
2016-01-13 08:05:03 ----A---- C:\Windows\system32\SysFxUI.dll
2016-01-13 08:05:03 ----A---- C:\Windows\system32\qasf.dll
2016-01-13 08:05:03 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2016-01-13 08:05:02 ----A---- C:\Windows\SYSWOW64\rrinstaller.exe
2016-01-13 08:05:02 ----A---- C:\Windows\SYSWOW64\mfvdsp.dll
2016-01-13 08:05:02 ----A---- C:\Windows\SYSWOW64\mfps.dll
2016-01-13 08:05:02 ----A---- C:\Windows\SYSWOW64\mfpmp.exe
2016-01-13 08:05:02 ----A---- C:\Windows\system32\rrinstaller.exe
2016-01-13 08:05:02 ----A---- C:\Windows\system32\mfps.dll
2016-01-13 08:05:02 ----A---- C:\Windows\system32\mfpmp.exe
2016-01-13 08:05:02 ----A---- C:\Windows\system32\drivers\portcls.sys
2016-01-13 08:05:00 ----A---- C:\Windows\SYSWOW64\mferror.dll
2016-01-13 08:05:00 ----A---- C:\Windows\SYSWOW64\ksuser.dll
2016-01-13 08:05:00 ----A---- C:\Windows\system32\mferror.dll
2016-01-13 08:05:00 ----A---- C:\Windows\system32\ksuser.dll
2016-01-13 08:05:00 ----A---- C:\Windows\system32\drivers\drmkaud.sys
2016-01-13 08:05:00 ----A---- C:\Windows\system32\drivers\drmk.sys
2016-01-13 08:04:57 ----A---- C:\Windows\system32\win32k.sys
2016-01-13 08:04:49 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2016-01-13 08:04:49 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2016-01-13 08:04:49 ----A---- C:\Windows\system32\iertutil.dll
2016-01-13 08:04:49 ----A---- C:\Windows\system32\ieetwcollector.exe
2016-01-13 08:04:48 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2016-01-13 08:04:48 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2016-01-13 08:04:48 ----A---- C:\Windows\system32\ieetwproxystub.dll
2016-01-13 08:04:47 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\occache.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2016-01-13 08:04:46 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2016-01-13 08:04:46 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-01-13 08:04:46 ----A---- C:\Windows\system32\iernonce.dll
2016-01-13 08:04:46 ----A---- C:\Windows\system32\ie4uinit.exe
2016-01-13 08:04:45 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2016-01-13 08:04:45 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2016-01-13 08:04:42 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2016-01-13 08:04:42 ----A---- C:\Windows\SYSWOW64\jscript.dll
2016-01-13 08:04:42 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2016-01-13 08:04:42 ----A---- C:\Windows\system32\urlmon.dll
2016-01-13 08:04:42 ----A---- C:\Windows\system32\occache.dll
2016-01-13 08:04:42 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2016-01-13 08:04:42 ----A---- C:\Windows\system32\iedkcs32.dll
2016-01-13 08:04:41 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2016-01-13 08:04:41 ----A---- C:\Windows\SYSWOW64\ieui.dll
2016-01-13 08:04:41 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2016-01-13 08:04:41 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2016-01-13 08:04:41 ----A---- C:\Windows\system32\msfeeds.dll
2016-01-13 08:04:41 ----A---- C:\Windows\system32\dxtrans.dll
2016-01-13 08:04:40 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2016-01-13 08:04:39 ----A---- C:\Windows\system32\iesetup.dll
2016-01-13 08:04:37 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2016-01-13 08:04:37 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2016-01-13 08:04:36 ----A---- C:\Windows\SYSWOW64\wininet.dll
2016-01-13 08:04:36 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2016-01-13 08:04:36 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2016-01-13 08:04:36 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2016-01-13 08:04:36 ----A---- C:\Windows\system32\vbscript.dll
2016-01-13 08:04:35 ----A---- C:\Windows\SYSWOW64\msrating.dll
2016-01-13 08:04:35 ----A---- C:\Windows\system32\jsproxy.dll
2016-01-13 08:04:34 ----A---- C:\Windows\system32\ieui.dll
2016-01-13 08:04:34 ----A---- C:\Windows\system32\dxtmsft.dll
2016-01-13 08:04:33 ----A---- C:\Windows\system32\ieframe.dll
2016-01-13 08:04:32 ----A---- C:\Windows\system32\mshtmlmedia.dll
2016-01-13 08:04:32 ----A---- C:\Windows\system32\mshtmled.dll
2016-01-13 08:04:31 ----A---- C:\Windows\system32\webcheck.dll
2016-01-13 08:04:31 ----A---- C:\Windows\system32\jscript.dll
2016-01-13 08:04:31 ----A---- C:\Windows\system32\ieUnatt.exe
2016-01-13 08:04:30 ----A---- C:\Windows\system32\jscript9diag.dll
2016-01-13 08:04:30 ----A---- C:\Windows\system32\jscript9.dll
2016-01-13 08:04:29 ----A---- C:\Windows\system32\wininet.dll
2016-01-13 08:04:29 ----A---- C:\Windows\system32\ieapfltr.dll
2016-01-13 08:04:27 ----A---- C:\Windows\system32\msrating.dll
2016-01-13 08:04:27 ----A---- C:\Windows\system32\MshtmlDac.dll
2016-01-13 08:04:26 ----A---- C:\Windows\system32\mshtml.dll
2016-01-13 08:03:50 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2016-01-13 08:03:50 ----A---- C:\Windows\system32\advapi32.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\invagent.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\generaltel.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\devinv.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\CompatTelRunner.exe
2016-01-13 08:03:48 ----A---- C:\Windows\system32\appraiser.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\aepic.dll
2016-01-13 08:03:48 ----A---- C:\Windows\system32\acmigration.dll
2016-01-13 08:03:46 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2016-01-13 08:03:46 ----A---- C:\Windows\system32\gdi32.dll
2016-01-13 08:03:37 ----A---- C:\Windows\system32\rpcrt4.dll
2016-01-13 08:03:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2016-01-13 08:03:35 ----A---- C:\Windows\system32\schannel.dll
2016-01-13 08:03:35 ----A---- C:\Windows\system32\kerberos.dll
2016-01-13 08:03:34 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2016-01-13 08:03:33 ----A---- C:\Windows\SYSWOW64\schannel.dll
2016-01-13 08:03:33 ----A---- C:\Windows\system32\lsasrv.dll
2016-01-13 08:03:32 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2016-01-13 08:03:32 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2016-01-13 08:03:32 ----A---- C:\Windows\system32\ncrypt.dll
2016-01-13 08:03:31 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2016-01-13 08:03:31 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2016-01-13 08:03:31 ----A---- C:\Windows\system32\TSpkg.dll
2016-01-13 08:03:31 ----A---- C:\Windows\system32\msv1_0.dll
2016-01-13 08:03:31 ----A---- C:\Windows\system32\kernel32.dll
2016-01-13 08:03:31 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2016-01-13 08:03:30 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2016-01-13 08:03:30 ----A---- C:\Windows\system32\wdigest.dll
2016-01-13 08:03:29 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2016-01-13 08:03:29 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2016-01-13 08:03:29 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2016-01-13 08:03:29 ----A---- C:\Windows\system32\ntdll.dll
2016-01-13 08:03:29 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2016-01-13 08:03:28 ----A---- C:\Windows\SYSWOW64\credssp.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\winsrv.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\sspicli.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\secur32.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\cryptbase.dll
2016-01-13 08:03:28 ----A---- C:\Windows\system32\credssp.dll
2016-01-13 08:03:27 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2016-01-13 08:03:27 ----A---- C:\Windows\SYSWOW64\secur32.dll
2016-01-13 08:03:27 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2016-01-13 08:03:27 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2016-01-13 08:03:27 ----A---- C:\Windows\system32\sspisrv.dll
2016-01-13 08:03:27 ----A---- C:\Windows\system32\smss.exe
2016-01-13 08:03:27 ----A---- C:\Windows\system32\ntvdm64.dll
2016-01-13 08:03:27 ----A---- C:\Windows\system32\lsass.exe
2016-01-13 08:03:27 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2016-01-13 08:03:27 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2016-01-13 08:03:26 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\wow64win.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\wow64.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\srcore.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\KernelBase.dll
2016-01-13 08:03:26 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2016-01-13 08:03:26 ----A---- C:\Windows\system32\conhost.exe
2016-01-13 08:03:25 ----A---- C:\Windows\SYSWOW64\srclient.dll
2016-01-13 08:03:25 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2016-01-13 08:03:25 ----A---- C:\Windows\system32\wow64cpu.dll
2016-01-13 08:03:25 ----A---- C:\Windows\system32\srclient.dll
2016-01-13 08:03:25 ----A---- C:\Windows\system32\rstrui.exe
2016-01-13 08:03:25 ----A---- C:\Windows\system32\csrsrv.dll
2016-01-13 08:03:25 ----A---- C:\Windows\system32\auditpol.exe
2016-01-13 08:03:24 ----A---- C:\Windows\SYSWOW64\wow32.dll
2016-01-13 08:03:24 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2016-01-13 08:03:24 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2016-01-13 08:03:24 ----A---- C:\Windows\system32\apisetschema.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-13 08:03:23 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-01-13 08:03:23 ----A---- C:\Windows\SYSWOW64\instnm.exe
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-01-13 08:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-01-13 08:03:22 ----A---- C:\Windows\SYSWOW64\setup16.exe
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-01-13 08:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-01-13 08:03:20 ----A---- C:\Windows\SYSWOW64\user.exe
2016-01-13 08:03:20 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2016-01-13 08:03:20 ----A---- C:\Windows\system32\adtschema.dll
2016-01-13 08:03:19 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2016-01-13 08:03:19 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2016-01-13 08:03:19 ----A---- C:\Windows\system32\msobjs.dll
2016-01-13 08:03:19 ----A---- C:\Windows\system32\msaudite.dll
2016-01-13 06:36:32 ----A---- C:\Windows\system32\aswBoot.exe
2016-01-13 06:36:15 ----A---- C:\Windows\avastSS.scr
2016-01-08 20:40:01 ----D---- C:\Program Files\CCleaner
2016-01-08 20:04:43 ----A---- C:\Windows\system32\drivers\mwac.sys
2016-01-08 20:04:43 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2016-01-08 20:04:42 ----D---- C:\ProgramData\Malwarebytes
2016-01-08 20:04:42 ----A---- C:\Windows\system32\drivers\mbam.sys

======List of files/folders modified in the last 1 month======

2016-01-24 09:14:13 ----D---- C:\Windows\Temp
2016-01-24 09:13:20 ----D---- C:\Windows\Prefetch
2016-01-24 09:09:41 ----D---- C:\Windows\system32\config
2016-01-24 09:08:07 ----D---- C:\Windows\Tasks
2016-01-24 09:05:27 ----D---- C:\Windows\System32
2016-01-24 09:05:27 ----D---- C:\Windows\inf
2016-01-24 09:05:27 ----A---- C:\Windows\system32\PerfStringBackup.INI
2016-01-23 18:11:56 ----D---- C:\Windows\system32\drivers
2016-01-23 18:09:35 ----HD---- C:\ProgramData
2016-01-23 18:09:33 ----RD---- C:\Program Files (x86)
2016-01-23 18:09:33 ----D---- C:\Program Files (x86)\Common Files
2016-01-23 11:52:18 ----SHD---- C:\System Volume Information
2016-01-23 07:43:42 ----RD---- C:\Program Files
2016-01-19 20:05:25 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2016-01-19 20:05:07 ----D---- C:\Windows\SysWOW64
2016-01-18 14:15:23 ----D---- C:\Windows\tracing
2016-01-17 17:02:08 ----D---- C:\Users\Valča\AppData\Roaming\Seznam.cz
2016-01-17 16:58:58 ----D---- C:\Users\Valča\AppData\Roaming\Skype
2016-01-17 16:58:21 ----D---- C:\Users\Valča\AppData\Roaming\Dropbox
2016-01-17 16:58:13 ----D---- C:\Users\Valča\AppData\Roaming\DropboxMaster
2016-01-16 20:37:45 ----D---- C:\Windows\rescache
2016-01-16 07:38:37 ----D---- C:\Windows\winsxs
2016-01-16 07:36:41 ----D---- C:\Windows\SYSWOW64\cs-CZ
2016-01-16 07:36:40 ----D---- C:\Windows\system32\cs-CZ
2016-01-16 07:36:39 ----D---- C:\Windows\AppPatch
2016-01-16 07:21:03 ----SHD---- C:\Windows\Installer
2016-01-16 07:21:03 ----SHD---- C:\Config.Msi
2016-01-15 07:50:31 ----D---- C:\Program Files\Microsoft Silverlight
2016-01-15 07:50:30 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2016-01-15 07:48:49 ----D---- C:\Windows\SYSWOW64\en-US
2016-01-15 07:48:49 ----D---- C:\Program Files\Internet Explorer
2016-01-15 07:48:48 ----D---- C:\Windows\system32\en-US
2016-01-15 07:48:47 ----D---- C:\Program Files (x86)\Internet Explorer
2016-01-15 07:48:46 ----SD---- C:\Windows\system32\CompatTel
2016-01-15 07:48:46 ----D---- C:\Windows\system32\appraiser
2016-01-15 07:48:44 ----D---- C:\Windows\system32\DriverStore
2016-01-15 07:47:37 ----D---- C:\ProgramData\Microsoft Help
2016-01-15 07:40:46 ----A---- C:\Windows\win.ini
2016-01-15 07:20:38 ----D---- C:\Windows\system32\MRT
2016-01-15 07:20:37 ----D---- C:\Windows\debug
2016-01-15 07:20:28 ----A---- C:\Windows\system32\MRT.exe
2016-01-13 07:59:57 ----D---- C:\Windows\system32\catroot2
2016-01-13 06:36:49 ----D---- C:\Windows\system32\Tasks
2016-01-13 06:36:30 ----D---- C:\Windows
2016-01-08 20:45:05 ----D---- C:\Users\Valča\AppData\Roaming\DAEMON Tools Lite
2016-01-08 20:44:31 ----D---- C:\Windows\ModemLogs
2016-01-08 20:44:29 ----D---- C:\Windows\Minidump
2016-01-08 20:44:29 ----D---- C:\Windows\Logs
2015-12-26 10:45:47 ----D---- C:\Users\Valča\AppData\Roaming\Apple Computer
2015-12-25 14:07:59 ----D---- C:\Windows\Microsoft.NET

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2016-01-13 65224]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2016-01-13 273784]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2016-01-13 93528]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2016-01-21 1065208]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2016-01-21 464256]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [2015-09-24 498512]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2016-01-13 28656]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2016-01-13 97648]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2016-01-13 155304]
R2 WCMVCAM;WebcamMax, WDM Video Capture; C:\Windows\system32\DRIVERS\wcmvcam64.sys [2012-04-15 1071032]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-05-24 9359872]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-05-24 309760]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-04-29 2727424]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2011-03-30 114704]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2011-03-25 1583744]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2011-01-25 77424]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-01-13 1412144]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2010-11-28 44672]
S3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys []
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys []
S3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys []
S3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys []
S3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys []
S3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys []
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device; C:\Windows\system32\DRIVERS\ew_hwusbdev.sys []
S3 ew_usbenumfilter;huawei_CompositeFilter; C:\Windows\system32\DRIVERS\ew_usbenumfilter.sys []
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2014-03-31 58056]
S3 huawei_cdcacm;huawei_cdcacm; C:\Windows\system32\DRIVERS\ew_jucdcacm.sys []
S3 huawei_enumerator;huawei_enumerator; C:\Windows\system32\DRIVERS\ew_jubusenum.sys []
S3 huawei_ext_ctrl;huawei_ext_ctrl; C:\Windows\system32\DRIVERS\ew_juextctrl.sys []
S3 huawei_wwanecm;huawei_wwanecm; C:\Windows\system32\DRIVERS\ew_juwwanecm.sys []
S3 netr28ux;RT2870 USB Wireless LAN Card Driver pro systém Windows Vista; C:\Windows\system32\DRIVERS\netr28ux.sys [2009-06-10 867328]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2013-02-19 19456]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-12-01 250984]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [2010-11-21 88960]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2013-02-19 29696]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-02-19 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2013-02-19 30208]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2015-06-17 54784]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-10-09 42496]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-12-13 82128]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-05-24 204288]
R2 Apple Mobile Device Service;Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2015-10-07 77104]
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2016-01-13 226440]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2015-08-12 462096]
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2010-12-17 198784]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2012-07-17 2292480]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2015-12-17 644880]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-07-09 327296]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-01-19 269504]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2014-03-31 1512640]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-12-12 114688]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2013-12-19 50942144]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-04-21 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]

-----------------EOF-----------------

Smazáno. Znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC. Nastala nějaká změna?

4GB volného místa je ale stále málo. Přesuňte některá svá data na jiné úložiště, nebo odinstalujte nepoužívané programy.

Právě to byl od začátku ten problém. Místo na disku mizelo samo od sebe. Nevím kolik tam bylo na začátku, ale v jednu chvíli tam bylo 30 GB a mizelo to samo až na snad 200 MB.

Udělejte ještě kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte. Zaplňování disku nemusí způsobovat vir.

Tímhle programem jsem to jednou předtím projel a pak ccleanerem a těch asi 30 GB to uvolnilo a pak se to velmi rychle zase plnilo.


<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2016/01/24 20:20:42 +0100</date>
<logfile>mbam-log-2016-01-24 (20-20-19).xml</logfile>
<isadmin>no</isadmin>
</header>em
<engine>
<version>2.2.0.1024</version>
<malware-database>v2016.01.24.05</malware-database>
<rootkit-database>v2016.01.20.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<hostname>VALERIE</hostname>
<ip>192.168.0.2</ip>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x64</arch>
<username>Mamka</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>249146</objects>
<time>974</time>
<processes>0</processes>
<modules>0</modules>
<keys>1</keys>
<values>1</values>
<datas>0</datas>
<folders>1</folders>
<files>0</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>enabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<key><path>HKLM\SOFTWARE\WOW6432NODE\WebexpEnhancedV1</path><vendor>PUP.Optional.WebExpEnhanced</vendor><action>success</action><hash>076e85b8326787af6d898e6233d05ea2</hash></key>
<value><path>HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS</path><valuename>ext@WebexpEnhancedV1alpha941.net</valuename><vendor>PUP.Optional.WebExpEnhanced</vendor><action>success</action><valuedata>C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha941\ff</valuedata><hash>660fe756f8a189ad61941dd346bd09f7</hash></value>
<folder><path>c:\users\valča\appdata\locallow\datamngr</path><vendor>PUP.Optional.DataMngr.AppFlsh</vendor><action>delete-on-reboot</action><hash>3144cc710990f6405d40963e14eeaf51</hash></folder>
</items>
</mbam-log>

Dejte log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

Combofix doběhl v pořádku, pak restartoval teď stále problikávají 3 okna, i po druhém restartu.