VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

prosim o kontrolu

https://forum.viry.cz:443/viewtopic.php?t=149297

Stránka 1 z 2

prosim o kontrolu

Napsal: 23 čer 2016 07:44
od Blanka yahoo
winds 7 se porad zasekava, je velmi pomaly, jen kdyz udelat restart. v nouzaku jede skoro ok.mbam, avpt, ccleaner udelala jsem jiz, naslo to par potvor.
tady rsit, dekuji vrele za pomoc.

Logfile of random's system information tool 1.10 (written by random/random)
Run by X220 at 2016-06-23 08:35:55
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 17 GB (14%) free of 122 GB
Total RAM: 8075 MB (90% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 08:35:56, on 2016-06-23
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18347)
Boot mode: Safe mode with network support

Running processes:
C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
C:\Program Files\trend micro\X220.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theguardian.com/international
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll
O4 - HKLM\..\Run: [PWMTRV] rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [IME14 CHS Uninstall] C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE /Uninstall /CHS /Log
O4 - HKLM\..\Run: [IME14 KOR Uninstall] C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE /Uninstall /KOR /Log
O4 - HKLM\..\Run: [IME14 JPN Uninstall] C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE /Uninstall /JPN /Log
O4 - HKLM\..\Run: [IME14 CHT Uninstall] C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE /Uninstall /CHT /Log
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_53D957690F7090EE22C9B2AAB3AEA4EE] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C0BB46D-762B-47A6-81D4-7694DC28FB1D}: Domain = huvudkontor.iktk.se
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C0BB46D-762B-47A6-81D4-7694DC28FB1D}: NameServer = 192.168.77.10 192.168.77.12
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: AcPrfMgrSvc - Lenovo - C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
O23 - Service: AcSvc - Lenovo - C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - Avast Software s.r.o. - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EPSON V3 Service4(04) (EPSON_PM_RPCV4_04) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Tjänsten Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Tjänsten Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Lenovo Solution Center System Service (LSC.Services.SystemService) - Lenovo - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mobile Broadband HL Service - Unknown owner - C:\ProgramData\MobileBrServ\mbbservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Power Manager Service (Power Manager DBC Service) - Lenovo - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Conexant SmartAudio service (SAService) - Conexant Systems, Inc. - C:\Windows\system32\SAsrv.exe
O23 - Service: ShareItSvc - SHAREit Technologies Co.Ltd - C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Screen Reading Optimizer Service Program (SROSVC) - Lenovo Group Limited - C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files (x86)\Lenovo\System Update\SUService.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Unknown owner - C:\Windows\System32\TPHDEXLG64.exe (file missing)
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

--
End of file - 12487 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\Explorer.EXE
ctfmon.exe
"C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe" -Embedding
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
"C:\Program Files\Windows Media Player\wmpnscfg.exe"
"C:\Program Files\Windows Media Player\wmpnscfg.exe"
"C:\Program Files\Windows Media Player\wmpnscfg.exe"
"C:\Program Files\Windows Media Player\wmpnscfg.exe"
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
"C:\Program Files\Windows Media Player\wmpnscfg.exe"
"C:\Users\X220\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2010-01-21 6723984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-09 662672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-01-16 688528]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-05-27 163536]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-14 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-09 565304]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office15\URLREDIR.DLL [2014-01-22 707800]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL [2016-05-17 1741096]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-14 172968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"TpShocks"=C:\Windows\system32\TpShocks.exe [2014-02-17 384344]
"AcWin7Hlpr"=C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [2015-06-08 63728]
"LENOVO.TPKNRRES"=C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [2013-05-29 60920]
"ALCKRESI.EXE"=C:\Program Files\Lenovo\AutoLock\ALCKRESI.EXE [2013-04-15 388600]
"PasswordManager"=C:\Program Files\Lenovo\Password Manager\password_manager.exe [2014-06-23 1665824]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SAIICpl.exe [2010-12-14 316032]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2013-02-19 170304]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2013-02-19 398656]
"Persistence"=C:\Windows\system32\igfxpers.exe [2013-02-19 441152]
"IME14 CHS Uninstall"=C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 110776]
"IME14 KOR Uninstall"=C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 110776]
"IME14 JPN Uninstall"=C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 110776]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"GoogleChromeAutoLaunch_53D957690F7090EE22C9B2AAB3AEA4EE"=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [2016-06-15 941720]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"PWMTRV"=rundll32 C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL,PwrMgrBkGndMonitor []
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-05-12 5515496]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-01-21 91520]
"IME14 CHS Uninstall"=C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 81080]
"IME14 KOR Uninstall"=C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 81080]
"IME14 JPN Uninstall"=C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 81080]
"IME14 CHT Uninstall"=C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 81080]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2013-02-19 441856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\wpdshserviceobj.dll [2010-11-21 115200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll [2009-05-12 275360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2010-01-21 6723984]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2016-06-22 17:04:21 ----D---- C:\Program Files (x86)\CleanUp!
2016-06-22 09:47:54 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2016-06-22 09:47:40 ----A---- C:\Windows\system32\drivers\mwac.sys
2016-06-22 09:47:40 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2016-06-22 09:47:40 ----A---- C:\Windows\system32\drivers\mbam.sys
2016-06-22 09:47:37 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-06-22 09:09:01 ----D---- C:\Program Files\BitTorrent
2016-06-22 09:08:43 ----A---- C:\Users\X220\AppData\Roaming\agent.dat
2016-06-22 09:08:24 ----A---- C:\Users\X220\AppData\Roaming\Installer.dat
2016-06-22 09:08:02 ----D---- C:\Program Files (x86)\KMSPico 10.0.6
2016-06-21 11:36:30 ----D---- C:\Program Files (x86)\Microsoft Synchronization Services
2016-06-21 11:36:18 ----D---- C:\Windows\PCHEALTH
2016-06-21 11:36:18 ----D---- C:\Program Files (x86)\Microsoft Sync Framework
2016-06-21 11:36:18 ----D---- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2016-06-19 10:26:55 ----SHD---- C:\$RECYCLE.BIN
2016-06-19 10:26:02 ----A---- C:\ComboFix.txt
2016-06-19 09:19:39 ----D---- C:\Program Files (x86)\mpck
2016-06-19 08:59:51 ----D---- C:\Users\X220\AppData\Roaming\Profiles
2016-06-19 08:59:50 ----D---- C:\Program Files (x86)\Phakichreenash
2016-06-17 23:28:33 ----D---- C:\KVRT_Data
2016-06-17 09:30:18 ----D---- C:\Windows\rescache
2016-06-17 08:02:33 ----D---- C:\ProgramData\Malwarebytes
2016-06-16 15:17:49 ----D---- C:\Windows\temp
2016-06-16 13:43:13 ----A---- C:\Windows\NIRCMD.exe
2016-06-16 12:26:55 ----A---- C:\Windows\zip.exe
2016-06-16 12:26:55 ----A---- C:\Windows\SWSC.exe
2016-06-16 12:26:55 ----A---- C:\Windows\SWREG.exe
2016-06-16 12:26:55 ----A---- C:\Windows\sed.exe
2016-06-16 12:26:55 ----A---- C:\Windows\PEV.exe
2016-06-16 12:26:55 ----A---- C:\Windows\MBR.exe
2016-06-16 12:26:55 ----A---- C:\Windows\grep.exe
2016-06-16 12:26:35 ----D---- C:\Qoobox
2016-06-16 11:46:39 ----A---- C:\Windows\SYSWOW64\tzres.dll
2016-06-16 11:46:39 ----A---- C:\Windows\system32\tzres.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\secur32.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\schannel.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\credssp.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\certcli.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\bcryptprimitives.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\wdigest.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\TSpkg.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\sspisrv.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\sspicli.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\secur32.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\schannel.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\rpcrt4.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\rpchttp.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\ncrypt.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\msv1_0.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\msobjs.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\msaudite.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\lsass.exe
2016-06-16 11:46:38 ----A---- C:\Windows\system32\lsasrv.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\kerberos.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\srvnet.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\srv2.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\srv.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\cng.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\cryptbase.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\credssp.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\certcli.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\bcryptprimitives.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\auditpol.exe
2016-06-16 11:46:38 ----A---- C:\Windows\system32\adtschema.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\lpk.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\lpk.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\fontsub.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\dciman32.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\atmlib.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\atmfd.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\ws2_32.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\winipsec.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\winhttp.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\StructuredQuery.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\polstore.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\netbtugc.exe
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\mswsock.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\gpscript.exe
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\gpscript.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\gpprefcl.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\gpapi.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\FwRemoteSvr.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\ws2_32.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\winipsec.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\winhttp.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\win32k.sys
2016-06-16 11:46:36 ----A---- C:\Windows\system32\StructuredQuery.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\polstore.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\netbtugc.exe
2016-06-16 11:46:36 ----A---- C:\Windows\system32\mswsock.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\IPSECSVC.DLL
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpsvc.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpscript.exe
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpscript.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpprefcl.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpapi.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\drivers\netbt.sys
2016-06-16 11:46:35 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2016-06-16 11:46:35 ----A---- C:\Windows\system32\gdi32.dll
2016-06-16 11:46:34 ----A---- C:\Windows\SYSWOW64\webio.dll
2016-06-16 11:46:34 ----A---- C:\Windows\system32\webio.dll
2016-06-16 11:46:32 ----A---- C:\Windows\SYSWOW64\shell32.dll
2016-06-16 11:46:32 ----A---- C:\Windows\SYSWOW64\explorer.exe
2016-06-16 11:46:32 ----A---- C:\Windows\system32\shell32.dll
2016-06-16 11:46:32 ----A---- C:\Windows\system32\ExplorerFrame.dll
2016-06-16 11:46:32 ----A---- C:\Windows\explorer.exe
2016-06-16 11:46:31 ----A---- C:\Windows\SYSWOW64\ExplorerFrame.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\invagent.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\generaltel.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\devinv.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\CompatTelRunner.exe
2016-06-16 11:44:06 ----A---- C:\Windows\system32\centel.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\appraiser.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\aeinv.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\acmigration.dll
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\msimsg.dll
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\msiexec.exe
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\msi.dll
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\authui.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\msimsg.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\msihnd.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\msiexec.exe
2016-06-16 11:44:00 ----A---- C:\Windows\system32\msi.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\consent.exe
2016-06-16 11:44:00 ----A---- C:\Windows\system32\authui.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\appinfo.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\occache.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\inseng.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\inseng.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\iernonce.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\ieetwproxystub.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\ieetwcollector.exe
2016-06-16 11:43:57 ----A---- C:\Windows\system32\ie4uinit.exe
2016-06-16 11:43:56 ----A---- C:\Windows\SYSWOW64\jscript.dll
2016-06-16 11:43:56 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2016-06-16 11:43:56 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2016-06-16 11:43:56 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2016-06-16 11:43:56 ----A---- C:\Windows\system32\urlmon.dll
2016-06-16 11:43:56 ----A---- C:\Windows\system32\occache.dll
2016-06-16 11:43:56 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2016-06-16 11:43:56 ----A---- C:\Windows\system32\iedkcs32.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\ieui.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2016-06-16 11:43:55 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2016-06-16 11:43:55 ----A---- C:\Windows\system32\msfeeds.dll
2016-06-16 11:43:55 ----A---- C:\Windows\system32\iesetup.dll
2016-06-16 11:43:55 ----A---- C:\Windows\system32\ieapfltr.dll
2016-06-16 11:43:55 ----A---- C:\Windows\system32\dxtrans.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\wininet.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\msrating.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2016-06-16 11:43:54 ----A---- C:\Windows\system32\vbscript.dll
2016-06-16 11:43:54 ----A---- C:\Windows\system32\jsproxy.dll
2016-06-16 11:43:54 ----A---- C:\Windows\system32\iertutil.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\mshtmlmedia.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\mshtmled.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\ieui.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\ieframe.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\dxtmsft.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\wininet.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\webcheck.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\jscript9diag.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\jscript9.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\jscript.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\ieUnatt.exe
2016-06-16 11:43:51 ----A---- C:\Windows\system32\msrating.dll
2016-06-16 11:43:51 ----A---- C:\Windows\system32\MshtmlDac.dll
2016-06-16 11:43:51 ----A---- C:\Windows\system32\mshtml.dll
2016-05-31 22:08:45 ----D---- C:\$WINDOWS.~BT
2016-05-31 09:57:17 ----D---- C:\Users\X220\AppData\Roaming\webex
2016-05-31 09:56:25 ----D---- C:\ProgramData\WebEx

======List of files/folders modified in the last 1 month======

2016-06-23 08:35:56 ----D---- C:\Program Files\trend micro
2016-06-23 08:35:38 ----A---- C:\Windows\ntbtlog.txt
2016-06-23 07:47:33 ----D---- C:\Windows\System32
2016-06-23 07:47:33 ----A---- C:\Windows\system32\PerfStringBackup.INI
2016-06-23 07:44:53 ----D---- C:\Windows\system32\config
2016-06-23 07:44:13 ----D---- C:\Program Files\Microsoft Silverlight
2016-06-23 07:44:13 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2016-06-23 01:12:11 ----SHD---- C:\Windows\Installer
2016-06-23 01:12:11 ----D---- C:\Config.Msi
2016-06-23 01:11:19 ----SHD---- C:\System Volume Information
2016-06-22 22:03:01 ----D---- C:\Windows\system32\drivers
2016-06-22 17:04:21 ----RD---- C:\Program Files (x86)
2016-06-22 16:54:34 ----D---- C:\AdwCleaner
2016-06-22 16:53:02 ----D---- C:\Windows\SysWOW64
2016-06-22 16:53:02 ----D---- C:\Windows\system32\Tasks
2016-06-22 16:53:02 ----D---- C:\ProgramData
2016-06-22 09:41:35 ----RD---- C:\Program Files
2016-06-22 09:41:04 ----D---- C:\Users\X220\AppData\Roaming\uTorrent
2016-06-22 09:24:31 ----D---- C:\Windows
2016-06-22 09:24:07 ----D---- C:\Program Files (x86)\Common Files
2016-06-21 15:40:25 ----D---- C:\Program Files\Common Files\Microsoft Shared
2016-06-21 15:09:39 ----D---- C:\Windows\Logs
2016-06-21 14:03:15 ----D---- C:\ProgramData\Microsoft Help
2016-06-21 13:19:37 ----A---- C:\Windows\win.ini
2016-06-21 12:52:24 ----D---- C:\Windows\Microsoft.NET
2016-06-21 12:52:23 ----RSD---- C:\Windows\assembly
2016-06-21 11:53:29 ----D---- C:\Windows\Tasks
2016-06-21 11:53:29 ----D---- C:\Windows\AutoKMS
2016-06-21 11:37:59 ----D---- C:\Windows\winsxs
2016-06-21 11:36:47 ----RSD---- C:\Windows\Fonts
2016-06-21 11:36:39 ----D---- C:\Program Files (x86)\MSBuild
2016-06-21 11:36:30 ----D---- C:\Windows\ShellNew
2016-06-21 11:36:18 ----SD---- C:\ProgramData\Microsoft
2016-06-21 11:36:18 ----D---- C:\Program Files (x86)\Microsoft.NET
2016-06-21 11:36:18 ----D---- C:\Program Files (x86)\Microsoft Office
2016-06-21 11:35:43 ----D---- C:\Windows\system32\wbem
2016-06-21 11:35:33 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 8
2016-06-21 11:35:25 ----D---- C:\Program Files\Microsoft Office
2016-06-20 23:17:48 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2016-06-20 23:17:46 ----D---- C:\Program Files\Common Files
2016-06-20 16:41:23 ----SD---- C:\Users\X220\AppData\Roaming\Microsoft
2016-06-19 21:57:31 ----D---- C:\Windows\system32\FxsTmp
2016-06-19 10:11:04 ----A---- C:\Windows\system.ini
2016-06-19 09:54:16 ----D---- C:\Windows\SYSWOW64\drivers
2016-06-19 09:54:16 ----D---- C:\Windows\AppPatch
2016-06-18 20:02:19 ----D---- C:\Users\X220\AppData\Roaming\Skype
2016-06-18 19:29:26 ----D---- C:\Windows\system32\catroot2
2016-06-18 15:04:07 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2016-06-18 14:29:25 ----D---- C:\Windows\system32\NDF
2016-06-17 13:44:58 ----D---- C:\Users\X220\AppData\Roaming\Lenovo
2016-06-17 08:48:17 ----D---- C:\Windows\CSC
2016-06-17 08:39:25 ----D---- C:\Users\X220\AppData\Roaming\rmi
2016-06-17 07:59:13 ----D---- C:\Program Files (x86)\Lenovo
2016-06-17 07:58:52 ----D---- C:\ProgramData\Lenovo
2016-06-17 07:47:53 ----D---- C:\Windows\SYSWOW64\sv-SE
2016-06-17 07:47:53 ----D---- C:\Windows\SYSWOW64\en-US
2016-06-17 07:47:53 ----D---- C:\Windows\system32\sv-SE
2016-06-17 07:47:53 ----D---- C:\Windows\system32\en-US
2016-06-17 07:47:53 ----D---- C:\Windows\system32\appraiser
2016-06-17 07:47:52 ----D---- C:\Windows\sv-SE
2016-06-17 07:47:52 ----D---- C:\Windows\en-US
2016-06-17 07:47:52 ----D---- C:\Program Files\Internet Explorer
2016-06-17 07:47:51 ----D---- C:\Program Files (x86)\Internet Explorer
2016-06-16 15:18:23 ----D---- C:\Windows\system32\drivers\etc
2016-06-16 15:17:58 ----D---- C:\Windows\system32\catroot
2016-06-16 15:17:53 ----D---- C:\Windows\erdnt
2016-06-15 16:55:55 ----D---- C:\Windows\inf
2016-06-13 19:31:06 ----N---- C:\Windows\system32\MpSigStub.exe
2016-06-01 11:20:37 ----D---- C:\ProgramData\Skype
2016-06-01 11:20:31 ----RD---- C:\Program Files (x86)\Skype
2016-05-31 23:05:33 ----D---- C:\Windows\Panther
2016-05-30 09:36:17 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2016-05-30 09:36:17 ----D---- C:\Program Files (x86)\Mozilla Firefox
2016-05-27 06:15:25 ----SD---- C:\Windows\SYSWOW64\GWX
2016-05-27 06:15:25 ----SD---- C:\Windows\system32\GWX

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 DzHDD64;DzHDD64; C:\Windows\System32\DRIVERS\DzHDD64.sys [2016-04-14 29512]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2012-05-30 569152]
R0 iaStorA;iaStorA; C:\Windows\system32\DRIVERS\iaStorA.sys [2014-11-13 652784]
R0 iaStorF;iaStorF; C:\Windows\system32\DRIVERS\iaStorF.sys [2014-11-13 28656]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 Shockprf;Shockprf; C:\Windows\System32\DRIVERS\Apsx64.sys [2014-01-29 152888]
R0 TPDIGIMN;TPDIGIMN; C:\Windows\System32\DRIVERS\ApsHM64.sys [2014-01-29 29496]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2015-04-30 93528]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 risdxc;risdxc; C:\Windows\system32\DRIVERS\risdxc64.sys [2014-10-27 101888]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2014-06-27 495376]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2015-05-12 63464]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2014-10-27 125952]
R3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit; C:\Windows\system32\DRIVERS\NETwsw01.sys [2014-12-19 11523584]
R3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2014-07-28 45296]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2014-07-28 461552]
R3 TPM;TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2015-04-30 65736]
S0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2015-04-30 272248]
S1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2015-04-30 1047320]
S1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2015-06-27 442264]
S1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiifx64.sys [2013-05-22 15472]
S1 TPPWRIF;TPPWRIF; C:\Windows\System32\drivers\Tppwr64v.sys [2016-04-14 29008]
S2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2015-04-30 29168]
S2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2015-04-30 89944]
S2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2015-04-30 137288]
S3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2014-10-27 166016]
S3 b06diag;Broadcom NetXtreme II Diag Driver; C:\Windows\system32\drivers\bxdiaga.sys [2012-03-08 88104]
S3 BFN7x64;Bigfoot Networks Killer Gaming Service; C:\Windows\system32\drivers\Xeno7x64.sys [2012-02-22 157288]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2013-06-29 552960]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2013-06-29 80384]
S3 btwampfl;btwampfl Bluetooth filter driver; \??\C:\Windows\system32\drivers\btwampfl.sys [2012-12-04 598808]
S3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2012-05-02 184144]
S3 btwavdt;Bluetooth AVDT; C:\Windows\system32\DRIVERS\btwavdt.sys [2012-03-06 210984]
S3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2011-09-18 39976]
S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2012-03-06 21544]
S3 bxfcoe;bxfcoe; C:\Windows\system32\drivers\bxfcoe.sys [2012-02-22 178216]
S3 bxois;bxois; C:\Windows\system32\drivers\bxois.sys [2012-02-22 539176]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2014-10-27 1580704]
S3 cpuz134;cpuz134; \??\C:\Users\X220\AppData\Local\Temp\cpuz134\cpuz134_x64.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2013-02-19 9000256]
S3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2015-01-30 342528]
S3 ioatdma1;ioatdma1; C:\Windows\System32\Drivers\qd162x64.sys [2009-11-16 40144]
S3 ioatdma2;Intel(R) QuickData Technology device ver.2; C:\Windows\System32\Drivers\qd262x64.sys [2009-11-16 42192]
S3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2016-03-10 27008]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2016-06-22 192216]
S3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2016-03-10 64896]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2013-06-29 19456]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [2010-11-21 88960]
S3 Tdsshbecr;Handelsbanken card reader; C:\Windows\system32\DRIVERS\shbecr.sys [2008-09-28 50176]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2013-06-29 29696]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2013-06-29 30208]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
S3 usb_rndisx;USB RNDIS Adapter; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-06-29 19968]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 AcPrfMgrSvc;AcPrfMgrSvc; C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe [2015-06-08 133360]
S2 AcSvc;AcSvc; C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe [2015-06-08 276720]
S2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2016-04-22 82128]
S2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-04-30 343336]
S2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe [2013-05-14 1008344]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2015-11-05 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2015-11-05 125112]
S2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2010-12-17 198784]
S2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04); C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [2014-11-19 151648]
S2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2014-11-19 638368]
S2 gupdate;Tjänsten Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-05 144200]
S2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2015-05-12 102376]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2015-02-12 262920]
S2 LENOVO.CAMMUTE;Lenovo Camera Mute; C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [2013-05-29 44024]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-05-27 110128]
S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction; C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2013-05-29 62456]
S2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2016-03-10 1136608]
S2 Mobile Broadband HL Service;Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [2013-01-28 239184]
S2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2014-11-19 157088]
S2 SAService;Conexant SmartAudio service; C:\Windows\system32\SAsrv.exe []
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2016-03-23 327808]
S2 SROSVC;Screen Reading Optimizer Service Program; C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe [2012-03-05 446800]
S2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 125424]
S2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2014-05-27 125488]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-06-18 270016]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2015-11-05 51376]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2013-02-19 276288]
S3 DozeSvc;Lenovo Doze Mode Service; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2016-04-14 326160]
S3 gupdatem;Tjänsten Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-05 144200]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2012-04-24 169752]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2016-05-20 114688]
S3 LSC.Services.SystemService;Lenovo Solution Center System Service; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe [2016-04-20 273232]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2016-05-23 146888]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2014-11-19 268192]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2014-01-23 178760]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 5132888]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 Power Manager DBC Service;Power Manager Service; C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2016-04-14 1668776]
S3 ShareItSvc;ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [2016-01-20 31176]
S3 SUService;System Update; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [2016-05-25 21536]
S3 TPHDEXLGSVC;ThinkPad HDD APS Logging Service; C:\Windows\System32\TPHDEXLG64.exe [2014-01-29 49976]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-06-29 1255736]
S4 BitTorrent;BitTorrent; C:\Program Files\BitTorrent\BitTorrent.exe [2016-06-22 383488]
S4 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2016-03-10 1514464]
S4 NetMsmqActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetPipeActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetTcpActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]

-----------------EOF-----------------

Re: prosim o kontrolu

Napsal: 23 čer 2016 11:53
od Rudy
Zdravím!
Spusťte tuto utilitu:
Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

Re: prosim o kontrolu

Napsal: 23 čer 2016 13:07
od Blanka yahoo
# AdwCleaner v5.200 - Logfile created 23/06/2016 at 13:52:56
# Updated 14/06/2016 by ToolsLib
# Database : 2016-06-22.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (X64)
# Username : X220 - X220-PC
# Running from : C:\Users\X220\Downloads\adwcleaner_5.200.exe
# Option : Clean
# Support : https://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLLs ] *****


***** [ WMI ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\{8C4CE252-7DB2-4F8E-8E76-BAD0E5826A83}
[-] Key Deleted : HKU\.DEFAULT\Software\{8C4CE252-7DB2-4F8E-8E76-BAD0E5826A83}

***** [ Web browsers ] *****


*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [4229 bytes] - [20/06/2016 11:27:13]
C:\AdwCleaner\AdwCleaner[C2].txt - [1943 bytes] - [22/06/2016 16:54:34]
C:\AdwCleaner\AdwCleaner[C3].txt - [1029 bytes] - [23/06/2016 13:52:56]
C:\AdwCleaner\AdwCleaner[R0].txt - [2007 bytes] - [25/04/2015 22:15:26]
C:\AdwCleaner\AdwCleaner[R1].txt - [1095 bytes] - [14/05/2015 22:51:27]
C:\AdwCleaner\AdwCleaner[R2].txt - [2510 bytes] - [30/06/2015 17:02:37]
C:\AdwCleaner\AdwCleaner[S0].txt - [2103 bytes] - [25/04/2015 22:16:17]
C:\AdwCleaner\AdwCleaner[S1].txt - [5475 bytes] - [14/05/2015 22:52:15]
C:\AdwCleaner\AdwCleaner[S2].txt - [3799 bytes] - [30/06/2015 17:03:24]
C:\AdwCleaner\AdwCleaner[S3].txt - [1830 bytes] - [22/06/2016 16:53:36]
C:\AdwCleaner\AdwCleaner[S4].txt - [1665 bytes] - [23/06/2016 13:51:48]

########## EOF - C:\AdwCleaner\AdwCleaner[C3].txt - [1686 bytes] ##########

Re: prosim o kontrolu

Napsal: 23 čer 2016 13:35
od Rudy
Dejte nový log RSIT.

Re: prosim o kontrolu

Napsal: 23 čer 2016 14:04
od Blanka yahoo
je tam opravdu nejaka potvora, vse trva strasne dlouho. mam to radeji delat vse v nouzovem rezimu?

rsit

Logfile of random's system information tool 1.10 (written by random/random)
Run by X220 at 2016-06-23 14:58:23
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 18 GB (14%) free of 122 GB
Total RAM: 8075 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:58:25, on 2016-06-23
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18347)
Boot mode: Normal

Running processes:
C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe
C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files (x86)\Lenovo\Password Manager\pwm_ie_helper_desktop.exe
C:\Program Files (x86)\Lenovo\Password Manager\password_manager.exe
C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
C:\Program Files\trend micro\X220.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theguardian.com/international
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll
O4 - HKLM\..\Run: [PWMTRV] rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [IME14 CHS Uninstall] C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE /Uninstall /CHS /Log
O4 - HKLM\..\Run: [IME14 KOR Uninstall] C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE /Uninstall /KOR /Log
O4 - HKLM\..\Run: [IME14 JPN Uninstall] C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE /Uninstall /JPN /Log
O4 - HKLM\..\Run: [IME14 CHT Uninstall] C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE /Uninstall /CHT /Log
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_53D957690F7090EE22C9B2AAB3AEA4EE] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C0BB46D-762B-47A6-81D4-7694DC28FB1D}: Domain = huvudkontor.iktk.se
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C0BB46D-762B-47A6-81D4-7694DC28FB1D}: NameServer = 192.168.77.10 192.168.77.12
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: AcPrfMgrSvc - Lenovo - C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
O23 - Service: AcSvc - Lenovo - C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - Avast Software s.r.o. - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EPSON V3 Service4(04) (EPSON_PM_RPCV4_04) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Tjänsten Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Tjänsten Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Lenovo Solution Center System Service (LSC.Services.SystemService) - Lenovo - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mobile Broadband HL Service - Unknown owner - C:\ProgramData\MobileBrServ\mbbservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Power Manager Service (Power Manager DBC Service) - Lenovo - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Conexant SmartAudio service (SAService) - Conexant Systems, Inc. - C:\Windows\system32\SAsrv.exe
O23 - Service: ShareItSvc - SHAREit Technologies Co.Ltd - C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Screen Reading Optimizer Service Program (SROSVC) - Lenovo Group Limited - C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files (x86)\Lenovo\System Update\SUService.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Unknown owner - C:\Windows\System32\TPHDEXLG64.exe (file missing)
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

--
End of file - 13088 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ibmpmsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
winlogon.exe

C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\Windows\system32\WLANExt.exe 30780400
\??\C:\Windows\system32\conhost.exe "1311074061138835570283685568462775519-2070576727-179797498-1099733603-469079872
C:\Windows\System32\spoolsv.exe
taskeng.exe {2DE410AB-84B0-4201-9AD8-652DE7919F84}
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe" /backup /iavs
"C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe"
taskeng.exe {0C54B6B3-6A25-4465-8A51-D1FB85FF34C5}
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe"
C:\Windows\system32\CxAudMsg64.exe
C:\Windows\System32\svchost.exe -k utcsvc
"\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE"
"C:\Program Files\Intel\WiFi\bin\EvtEng.exe"
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe"
"C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe"
"C:\ProgramData\MobileBrServ\mbbservice.exe" -service
"C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe"
C:\Windows\SysWOW64\SAsrv.exe
"C:\Program Files (x86)\Skype\Updater\Updater.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe"
"C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe"
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k bthsvcs
"C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe" -Embedding
C:\Windows\system32\rundll32.exe "C:\Program Files\LENOVO\HOTKEY\hotkey.dll",InstallAudioHotkeyHook
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.FullScreenMagnifier
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
"C:\Windows\System32\TpShocks.exe"
"C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe"
"C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe"
"C:\Program Files\Lenovo\Password Manager\password_manager.exe"
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe"
"C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
"C:\Program Files (x86)\Lenovo\Password Manager\pwm_ie_helper_desktop.exe"
"C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe" /IpNotifyInstance
"C:\Program Files (x86)\Lenovo\Password Manager\password_manager.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\\SRORest.exe"
"C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Windows\system32\SearchFilterHost.exe" 0 524 528 536 65536 532
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Windows\SysWOW64\RunDll32.exe" "C:\Program Files\ThinkPad\Bluetooth Software\SysWOW64\BtMmHook.dll",SetAndWaitBtMmHook
"C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe" -Embedding
"C:\Windows\system32\GWX\GWX.exe"
C:\Windows\system32\sppsvc.exe
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
C:\Windows\servicing\TrustedInstaller.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20160623125715.log C:\Windows\Logs\CBS\CbsPersist_20160623125715.cab
\??\C:\Windows\system32\conhost.exe "552861711-676560762-578568954-72038475110591477285136586921954128500-174762280
C:\Windows\System32\GWX\GWXUX.exe -Embedding
wmiadap.exe /R /T
"C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe" /showasync
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
"C:\Users\X220\Downloads\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - C:\Users\X220\AppData\Roaming\Mozilla\Firefox\Profiles\en0h23em.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 22.0.0.192 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\SysWOW64\Adobe\Director\np32dsw_1214154.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@bankid.com/BankID säkerhetsprogram,version=6.2.2.1]
"Description"=BankID säkerhetsprogram
"Path"=C:\Program Files (x86)\BankID\npBispBrowser.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@bankid.com/BankID säkerhetsprogram,version=6.2.5.1]
"Description"=BankID säkerhetsprogram
"Path"=C:\Program Files (x86)\BankID\npBispBrowser.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.25.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.25.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 22.0.0.192 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_192.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL


C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2010-01-21 6723984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-09 662672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-01-16 688528]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-05-27 163536]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-14 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-09 565304]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office15\URLREDIR.DLL [2014-01-22 707800]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL [2016-05-17 1741096]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-14 172968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"TpShocks"=C:\Windows\system32\TpShocks.exe [2014-02-17 384344]
"AcWin7Hlpr"=C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [2015-06-08 63728]
"LENOVO.TPKNRRES"=C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [2013-05-29 60920]
"ALCKRESI.EXE"=C:\Program Files\Lenovo\AutoLock\ALCKRESI.EXE [2013-04-15 388600]
"PasswordManager"=C:\Program Files\Lenovo\Password Manager\password_manager.exe [2014-06-23 1665824]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SAIICpl.exe [2010-12-14 316032]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2013-02-19 170304]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2013-02-19 398656]
"Persistence"=C:\Windows\system32\igfxpers.exe [2013-02-19 441152]
"IME14 CHS Uninstall"=C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 110776]
"IME14 KOR Uninstall"=C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 110776]
"IME14 JPN Uninstall"=C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 110776]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"GoogleChromeAutoLaunch_53D957690F7090EE22C9B2AAB3AEA4EE"=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [2016-06-15 941720]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"PWMTRV"=rundll32 C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL,PwrMgrBkGndMonitor []
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-05-12 5515496]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-01-21 91520]
"IME14 CHS Uninstall"=C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 81080]
"IME14 KOR Uninstall"=C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 81080]
"IME14 JPN Uninstall"=C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 81080]
"IME14 CHT Uninstall"=C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 81080]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2013-02-19 441856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\wpdshserviceobj.dll [2010-11-21 115200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll [2009-05-12 275360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2010-01-21 6723984]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2016-06-23 13:04:48 ----HD---- C:\$GetCurrent
2016-06-23 13:04:44 ----D---- C:\Windows10Upgrade
2016-06-23 12:43:07 ----ASH---- C:\pagefile.sys
2016-06-23 12:43:04 ----ASH---- C:\hiberfil.sys
2016-06-23 10:21:28 ----D---- C:\Windows\pss
2016-06-22 17:04:21 ----D---- C:\Program Files (x86)\CleanUp!
2016-06-22 09:47:54 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2016-06-22 09:47:40 ----A---- C:\Windows\system32\drivers\mwac.sys
2016-06-22 09:47:40 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2016-06-22 09:47:40 ----A---- C:\Windows\system32\drivers\mbam.sys
2016-06-22 09:47:37 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-06-22 09:09:01 ----D---- C:\Program Files\BitTorrent
2016-06-22 09:08:43 ----A---- C:\Users\X220\AppData\Roaming\agent.dat
2016-06-22 09:08:24 ----A---- C:\Users\X220\AppData\Roaming\Installer.dat
2016-06-22 09:08:02 ----D---- C:\Program Files (x86)\KMSPico 10.0.6
2016-06-21 11:36:30 ----D---- C:\Program Files (x86)\Microsoft Synchronization Services
2016-06-21 11:36:18 ----D---- C:\Windows\PCHEALTH
2016-06-21 11:36:18 ----D---- C:\Program Files (x86)\Microsoft Sync Framework
2016-06-21 11:36:18 ----D---- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2016-06-19 10:26:55 ----SHD---- C:\$RECYCLE.BIN
2016-06-19 10:26:02 ----A---- C:\ComboFix.txt
2016-06-19 09:19:39 ----D---- C:\Program Files (x86)\mpck
2016-06-19 08:59:51 ----D---- C:\Users\X220\AppData\Roaming\Profiles
2016-06-19 08:59:50 ----D---- C:\Program Files (x86)\Phakichreenash
2016-06-17 23:28:33 ----D---- C:\KVRT_Data
2016-06-17 09:30:18 ----D---- C:\Windows\rescache
2016-06-17 08:02:33 ----D---- C:\ProgramData\Malwarebytes
2016-06-16 15:17:49 ----D---- C:\Windows\temp
2016-06-16 13:43:13 ----A---- C:\Windows\NIRCMD.exe
2016-06-16 12:26:55 ----A---- C:\Windows\zip.exe
2016-06-16 12:26:55 ----A---- C:\Windows\SWSC.exe
2016-06-16 12:26:55 ----A---- C:\Windows\SWREG.exe
2016-06-16 12:26:55 ----A---- C:\Windows\sed.exe
2016-06-16 12:26:55 ----A---- C:\Windows\PEV.exe
2016-06-16 12:26:55 ----A---- C:\Windows\MBR.exe
2016-06-16 12:26:55 ----A---- C:\Windows\grep.exe
2016-06-16 12:26:35 ----D---- C:\Qoobox
2016-06-16 11:46:39 ----A---- C:\Windows\SYSWOW64\tzres.dll
2016-06-16 11:46:39 ----A---- C:\Windows\system32\tzres.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\secur32.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\schannel.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\credssp.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\certcli.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\bcryptprimitives.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\wdigest.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\TSpkg.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\sspisrv.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\sspicli.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\secur32.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\schannel.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\rpcrt4.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\rpchttp.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\ncrypt.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\msv1_0.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\msobjs.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\msaudite.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\lsass.exe
2016-06-16 11:46:38 ----A---- C:\Windows\system32\lsasrv.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\kerberos.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\srvnet.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\srv2.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\srv.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\cng.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\cryptbase.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\credssp.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\certcli.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\bcryptprimitives.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\auditpol.exe
2016-06-16 11:46:38 ----A---- C:\Windows\system32\adtschema.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\lpk.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\lpk.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\fontsub.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\dciman32.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\atmlib.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\atmfd.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\ws2_32.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\winipsec.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\winhttp.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\StructuredQuery.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\polstore.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\netbtugc.exe
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\mswsock.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\gpscript.exe
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\gpscript.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\gpprefcl.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\gpapi.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\FwRemoteSvr.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\ws2_32.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\winipsec.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\winhttp.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\win32k.sys
2016-06-16 11:46:36 ----A---- C:\Windows\system32\StructuredQuery.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\polstore.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\netbtugc.exe
2016-06-16 11:46:36 ----A---- C:\Windows\system32\mswsock.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\IPSECSVC.DLL
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpsvc.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpscript.exe
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpscript.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpprefcl.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpapi.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\drivers\netbt.sys
2016-06-16 11:46:35 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2016-06-16 11:46:35 ----A---- C:\Windows\system32\gdi32.dll
2016-06-16 11:46:34 ----A---- C:\Windows\SYSWOW64\webio.dll
2016-06-16 11:46:34 ----A---- C:\Windows\system32\webio.dll
2016-06-16 11:46:32 ----A---- C:\Windows\SYSWOW64\shell32.dll
2016-06-16 11:46:32 ----A---- C:\Windows\SYSWOW64\explorer.exe
2016-06-16 11:46:32 ----A---- C:\Windows\system32\shell32.dll
2016-06-16 11:46:32 ----A---- C:\Windows\system32\ExplorerFrame.dll
2016-06-16 11:46:32 ----A---- C:\Windows\explorer.exe
2016-06-16 11:46:31 ----A---- C:\Windows\SYSWOW64\ExplorerFrame.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\invagent.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\generaltel.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\devinv.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\CompatTelRunner.exe
2016-06-16 11:44:06 ----A---- C:\Windows\system32\centel.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\appraiser.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\aeinv.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\acmigration.dll
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\msimsg.dll
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\msiexec.exe
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\msi.dll
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\authui.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\msimsg.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\msihnd.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\msiexec.exe
2016-06-16 11:44:00 ----A---- C:\Windows\system32\msi.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\consent.exe
2016-06-16 11:44:00 ----A---- C:\Windows\system32\authui.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\appinfo.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\occache.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\inseng.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\inseng.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\iernonce.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\ieetwproxystub.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\ieetwcollector.exe
2016-06-16 11:43:57 ----A---- C:\Windows\system32\ie4uinit.exe
2016-06-16 11:43:56 ----A---- C:\Windows\SYSWOW64\jscript.dll
2016-06-16 11:43:56 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2016-06-16 11:43:56 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2016-06-16 11:43:56 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2016-06-16 11:43:56 ----A---- C:\Windows\system32\urlmon.dll
2016-06-16 11:43:56 ----A---- C:\Windows\system32\occache.dll
2016-06-16 11:43:56 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2016-06-16 11:43:56 ----A---- C:\Windows\system32\iedkcs32.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\ieui.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2016-06-16 11:43:55 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2016-06-16 11:43:55 ----A---- C:\Windows\system32\msfeeds.dll
2016-06-16 11:43:55 ----A---- C:\Windows\system32\iesetup.dll
2016-06-16 11:43:55 ----A---- C:\Windows\system32\ieapfltr.dll
2016-06-16 11:43:55 ----A---- C:\Windows\system32\dxtrans.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\wininet.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\msrating.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2016-06-16 11:43:54 ----A---- C:\Windows\system32\vbscript.dll
2016-06-16 11:43:54 ----A---- C:\Windows\system32\jsproxy.dll
2016-06-16 11:43:54 ----A---- C:\Windows\system32\iertutil.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\mshtmlmedia.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\mshtmled.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\ieui.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\ieframe.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\dxtmsft.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\wininet.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\webcheck.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\jscript9diag.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\jscript9.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\jscript.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\ieUnatt.exe
2016-06-16 11:43:51 ----A---- C:\Windows\system32\msrating.dll
2016-06-16 11:43:51 ----A---- C:\Windows\system32\MshtmlDac.dll
2016-06-16 11:43:51 ----A---- C:\Windows\system32\mshtml.dll
2016-05-31 09:57:17 ----D---- C:\Users\X220\AppData\Roaming\webex
2016-05-31 09:56:25 ----D---- C:\ProgramData\WebEx

======List of files/folders modified in the last 1 month======

2016-06-23 22:41:44 ----D---- C:\Windows
2016-06-23 14:58:24 ----D---- C:\Program Files\trend micro
2016-06-23 14:57:15 ----D---- C:\Windows\system32\config
2016-06-23 14:02:47 ----D---- C:\Windows\winsxs
2016-06-23 14:02:08 ----D---- C:\Windows\system32\catroot2
2016-06-23 13:58:25 ----D---- C:\Windows\System32
2016-06-23 13:58:25 ----A---- C:\Windows\system32\PerfStringBackup.INI
2016-06-23 13:52:56 ----D---- C:\AdwCleaner
2016-06-23 12:43:13 ----HD---- C:\$WINDOWS.~BT
2016-06-23 12:24:58 ----D---- C:\Windows\registration
2016-06-23 12:21:36 ----D---- C:\Windows\Panther
2016-06-23 10:09:57 ----A---- C:\Windows\ntbtlog.txt
2016-06-23 07:44:13 ----D---- C:\Program Files\Microsoft Silverlight
2016-06-23 07:44:13 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2016-06-23 01:12:11 ----SHD---- C:\Windows\Installer
2016-06-23 01:12:11 ----D---- C:\Config.Msi
2016-06-23 01:11:19 ----SHD---- C:\System Volume Information
2016-06-22 22:03:01 ----D---- C:\Windows\system32\drivers
2016-06-22 17:04:21 ----RD---- C:\Program Files (x86)
2016-06-22 16:53:02 ----D---- C:\Windows\SysWOW64
2016-06-22 16:53:02 ----D---- C:\Windows\system32\Tasks
2016-06-22 16:53:02 ----D---- C:\ProgramData
2016-06-22 09:41:35 ----RD---- C:\Program Files
2016-06-22 09:41:04 ----D---- C:\Users\X220\AppData\Roaming\uTorrent
2016-06-22 09:24:07 ----D---- C:\Program Files (x86)\Common Files
2016-06-21 15:40:25 ----D---- C:\Program Files\Common Files\Microsoft Shared
2016-06-21 15:09:39 ----D---- C:\Windows\Logs
2016-06-21 14:03:15 ----D---- C:\ProgramData\Microsoft Help
2016-06-21 13:19:37 ----A---- C:\Windows\win.ini
2016-06-21 12:52:24 ----D---- C:\Windows\Microsoft.NET
2016-06-21 12:52:23 ----RSD---- C:\Windows\assembly
2016-06-21 11:53:29 ----D---- C:\Windows\Tasks
2016-06-21 11:53:29 ----D---- C:\Windows\AutoKMS
2016-06-21 11:36:47 ----RSD---- C:\Windows\Fonts
2016-06-21 11:36:39 ----D---- C:\Program Files (x86)\MSBuild
2016-06-21 11:36:30 ----D---- C:\Windows\ShellNew
2016-06-21 11:36:18 ----SD---- C:\ProgramData\Microsoft
2016-06-21 11:36:18 ----D---- C:\Program Files (x86)\Microsoft.NET
2016-06-21 11:36:18 ----D---- C:\Program Files (x86)\Microsoft Office
2016-06-21 11:35:43 ----D---- C:\Windows\system32\wbem
2016-06-21 11:35:33 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 8
2016-06-21 11:35:25 ----D---- C:\Program Files\Microsoft Office
2016-06-20 23:17:48 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2016-06-20 23:17:46 ----D---- C:\Program Files\Common Files
2016-06-20 16:41:23 ----SD---- C:\Users\X220\AppData\Roaming\Microsoft
2016-06-19 21:57:31 ----D---- C:\Windows\system32\FxsTmp
2016-06-19 10:11:04 ----A---- C:\Windows\system.ini
2016-06-19 09:54:16 ----D---- C:\Windows\SYSWOW64\drivers
2016-06-19 09:54:16 ----D---- C:\Windows\AppPatch
2016-06-18 20:02:19 ----D---- C:\Users\X220\AppData\Roaming\Skype
2016-06-18 15:04:07 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2016-06-18 14:29:25 ----D---- C:\Windows\system32\NDF
2016-06-17 13:44:58 ----D---- C:\Users\X220\AppData\Roaming\Lenovo
2016-06-17 08:48:17 ----D---- C:\Windows\CSC
2016-06-17 08:39:25 ----D---- C:\Users\X220\AppData\Roaming\rmi
2016-06-17 07:59:13 ----D---- C:\Program Files (x86)\Lenovo
2016-06-17 07:58:52 ----D---- C:\ProgramData\Lenovo
2016-06-17 07:47:53 ----D---- C:\Windows\SYSWOW64\sv-SE
2016-06-17 07:47:53 ----D---- C:\Windows\SYSWOW64\en-US
2016-06-17 07:47:53 ----D---- C:\Windows\system32\sv-SE
2016-06-17 07:47:53 ----D---- C:\Windows\system32\en-US
2016-06-17 07:47:53 ----D---- C:\Windows\system32\appraiser
2016-06-17 07:47:52 ----D---- C:\Windows\sv-SE
2016-06-17 07:47:52 ----D---- C:\Windows\en-US
2016-06-17 07:47:52 ----D---- C:\Program Files\Internet Explorer
2016-06-17 07:47:51 ----D---- C:\Program Files (x86)\Internet Explorer
2016-06-16 15:18:23 ----D---- C:\Windows\system32\drivers\etc
2016-06-16 15:17:58 ----D---- C:\Windows\system32\catroot
2016-06-16 15:17:53 ----D---- C:\Windows\erdnt
2016-06-15 16:55:55 ----D---- C:\Windows\inf
2016-06-13 19:31:06 ----N---- C:\Windows\system32\MpSigStub.exe
2016-06-01 11:20:37 ----D---- C:\ProgramData\Skype
2016-06-01 11:20:31 ----RD---- C:\Program Files (x86)\Skype
2016-05-30 09:36:17 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2016-05-30 09:36:17 ----D---- C:\Program Files (x86)\Mozilla Firefox
2016-05-27 06:15:25 ----SD---- C:\Windows\SYSWOW64\GWX
2016-05-27 06:15:25 ----SD---- C:\Windows\system32\GWX

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2015-04-30 65736]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2015-04-30 272248]
R0 DzHDD64;DzHDD64; C:\Windows\System32\DRIVERS\DzHDD64.sys [2016-04-14 29512]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2012-05-30 569152]
R0 iaStorA;iaStorA; C:\Windows\system32\DRIVERS\iaStorA.sys [2014-11-13 652784]
R0 iaStorF;iaStorF; C:\Windows\system32\DRIVERS\iaStorF.sys [2014-11-13 28656]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 Shockprf;Shockprf; C:\Windows\System32\DRIVERS\Apsx64.sys [2014-01-29 152888]
R0 TPDIGIMN;TPDIGIMN; C:\Windows\System32\DRIVERS\ApsHM64.sys [2014-01-29 29496]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2015-04-30 93528]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2015-04-30 1047320]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2015-06-27 442264]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiifx64.sys [2013-05-22 15472]
R1 TPPWRIF;TPPWRIF; C:\Windows\System32\drivers\Tppwr64v.sys [2016-04-14 29008]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2015-04-30 29168]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2015-04-30 89944]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2015-04-30 137288]
R2 risdxc;risdxc; C:\Windows\system32\DRIVERS\risdxc64.sys [2014-10-27 101888]
R3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2014-10-27 166016]
R3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2013-06-29 80384]
R3 btwampfl;btwampfl Bluetooth filter driver; \??\C:\Windows\system32\drivers\btwampfl.sys [2012-12-04 598808]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2012-05-02 184144]
R3 btwavdt;Bluetooth AVDT; C:\Windows\system32\DRIVERS\btwavdt.sys [2012-03-06 210984]
R3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2011-09-18 39976]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2012-03-06 21544]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2014-10-27 1580704]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2014-06-27 495376]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2015-05-12 63464]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2013-02-19 9000256]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2015-01-30 342528]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2016-03-10 27008]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2014-10-27 125952]
R3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit; C:\Windows\system32\DRIVERS\NETwsw01.sys [2014-12-19 11523584]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2014-07-28 45296]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2014-07-28 461552]
R3 TPM;TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 b06diag;Broadcom NetXtreme II Diag Driver; C:\Windows\system32\drivers\bxdiaga.sys [2012-03-08 88104]
S3 BFN7x64;Bigfoot Networks Killer Gaming Service; C:\Windows\system32\drivers\Xeno7x64.sys [2012-02-22 157288]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2013-06-29 552960]
S3 bxfcoe;bxfcoe; C:\Windows\system32\drivers\bxfcoe.sys [2012-02-22 178216]
S3 bxois;bxois; C:\Windows\system32\drivers\bxois.sys [2012-02-22 539176]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 cpuz134;cpuz134; \??\C:\Users\X220\AppData\Local\Temp\cpuz134\cpuz134_x64.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 ioatdma1;ioatdma1; C:\Windows\System32\Drivers\qd162x64.sys [2009-11-16 40144]
S3 ioatdma2;Intel(R) QuickData Technology device ver.2; C:\Windows\System32\Drivers\qd262x64.sys [2009-11-16 42192]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2016-06-22 192216]
S3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2016-03-10 64896]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2013-06-29 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [2010-11-21 88960]
S3 Tdsshbecr;Handelsbanken card reader; C:\Windows\system32\DRIVERS\shbecr.sys [2008-09-28 50176]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2013-06-29 29696]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2013-06-29 30208]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
S3 usb_rndisx;USB RNDIS Adapter; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-06-29 19968]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcPrfMgrSvc;AcPrfMgrSvc; C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe [2015-06-08 133360]
R2 AcSvc;AcSvc; C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe [2015-06-08 276720]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2016-04-22 82128]
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-04-30 343336]
R2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe [2013-05-14 1008344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2010-12-17 198784]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04); C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [2014-11-19 151648]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2014-11-19 638368]
R2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2015-05-12 102376]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2015-02-12 262920]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute; C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [2013-05-29 44024]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-05-27 110128]
R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction; C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2013-05-29 62456]
R2 Mobile Broadband HL Service;Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [2013-01-28 239184]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2014-11-19 157088]
R2 SAService;Conexant SmartAudio service; C:\Windows\system32\SAsrv.exe []
R2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2016-03-23 327808]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 125424]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2014-05-27 125488]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2012-04-24 169752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2015-11-05 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2015-11-05 125112]
S2 gupdate;Tjänsten Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-05 144200]
S2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2016-03-10 1136608]
S2 SROSVC;Screen Reading Optimizer Service Program; C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe [2012-03-05 446800]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-06-18 270016]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2015-11-05 51376]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2013-02-19 276288]
S3 DozeSvc;Lenovo Doze Mode Service; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2016-04-14 326160]
S3 gupdatem;Tjänsten Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-05 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2016-05-20 114688]
S3 LSC.Services.SystemService;Lenovo Solution Center System Service; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe [2016-04-20 273232]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2016-05-23 146888]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2014-11-19 268192]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2014-01-23 178760]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 5132888]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 Power Manager DBC Service;Power Manager Service; C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2016-04-14 1668776]
S3 ShareItSvc;ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [2016-01-20 31176]
S3 SUService;System Update; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [2016-05-25 21536]
S3 TPHDEXLGSVC;ThinkPad HDD APS Logging Service; C:\Windows\System32\TPHDEXLG64.exe [2014-01-29 49976]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-06-29 1255736]
S4 BitTorrent;BitTorrent; C:\Program Files\BitTorrent\BitTorrent.exe [2016-06-22 383488]
S4 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2016-03-10 1514464]
S4 NetMsmqActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetPipeActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetTcpActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]

-----------------EOF-----------------

Re: prosim o kontrolu

Napsal: 23 čer 2016 16:40
od Rudy
Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:files
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Před skenem vypněte antivir a po něm restartujte PC. Dejte nový log RSIT.

Nic zvláštního (až na pár AdWarů), tam nebylo. Obávám se poškození systému spuštěním ComboFixu (16.6.). Laiky před tím varujeme, ne nadarmo to máme i v pravidlech: http://forum.viry.cz/viewtopic.php?f=12&t=5601 (bod 3).

Re: prosim o kontrolu

Napsal: 23 čer 2016 17:16
od Blanka yahoo
combofix mi poradil pred par dny vas kolega a dal mi instrukce, co tam presne okopirovat...ja bych to vubec nevedela...

Logfile of random's system information tool 1.10 (written by random/random)
Run by X220 at 2016-06-23 18:11:12
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 22 GB (18%) free of 122 GB
Total RAM: 8075 MB (78% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:11:14, on 2016-06-23
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18347)
Boot mode: Normal

Running processes:
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files (x86)\Lenovo\Password Manager\pwm_ie_helper_desktop.exe
C:\Program Files (x86)\Lenovo\Password Manager\password_manager.exe
C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files\trend micro\X220.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theguardian.com/international
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll
O4 - HKLM\..\Run: [PWMTRV] rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [IME14 CHS Uninstall] C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE /Uninstall /CHS /Log
O4 - HKLM\..\Run: [IME14 KOR Uninstall] C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE /Uninstall /KOR /Log
O4 - HKLM\..\Run: [IME14 JPN Uninstall] C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE /Uninstall /JPN /Log
O4 - HKLM\..\Run: [IME14 CHT Uninstall] C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE /Uninstall /CHT /Log
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_53D957690F7090EE22C9B2AAB3AEA4EE] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C0BB46D-762B-47A6-81D4-7694DC28FB1D}: Domain = huvudkontor.iktk.se
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C0BB46D-762B-47A6-81D4-7694DC28FB1D}: NameServer = 192.168.77.10 192.168.77.12
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: AcPrfMgrSvc - Lenovo - C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
O23 - Service: AcSvc - Lenovo - C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - Avast Software s.r.o. - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EPSON V3 Service4(04) (EPSON_PM_RPCV4_04) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Tjänsten Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Tjänsten Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Lenovo Solution Center System Service (LSC.Services.SystemService) - Lenovo - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mobile Broadband HL Service - Unknown owner - C:\ProgramData\MobileBrServ\mbbservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Power Manager Service (Power Manager DBC Service) - Lenovo - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Conexant SmartAudio service (SAService) - Conexant Systems, Inc. - C:\Windows\system32\SAsrv.exe
O23 - Service: ShareItSvc - SHAREit Technologies Co.Ltd - C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Screen Reading Optimizer Service Program (SROSVC) - Lenovo Group Limited - C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files (x86)\Lenovo\System Update\SUService.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Unknown owner - C:\Windows\System32\TPHDEXLG64.exe (file missing)
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

--
End of file - 13208 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ibmpmsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
winlogon.exe

C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\Windows\system32\WLANExt.exe 30571680
\??\C:\Windows\system32\conhost.exe "-1931712124-1375750801298887707198041154617124040751061154660783936113-1391767031
C:\Windows\System32\spoolsv.exe
taskeng.exe {51240EC1-997F-4749-B56F-F315CA6CDEB1}
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe"
C:\Windows\system32\CxAudMsg64.exe
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE"
"C:\Program Files\Intel\WiFi\bin\EvtEng.exe"
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe"
"C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe"
"C:\ProgramData\MobileBrServ\mbbservice.exe" -service
"C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe"
C:\Windows\SysWOW64\SAsrv.exe
"C:\Program Files (x86)\Skype\Updater\Updater.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe"
"C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe"
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
"C:\Program Files\Intel\NCS2\WMIProv\NCS2Prov.exe" -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"taskhost.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
taskeng.exe {F4BE58F2-A88F-4214-9F96-C9E7BD281D0D}
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"\Program Files\Synaptics\SynTP\SynTPEnh.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\rundll32.exe "C:\Program Files\LENOVO\HOTKEY\hotkey.dll",InstallAudioHotkeyHook
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.FullScreenMagnifier
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 524 528 536 65536 532
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "http://192.168.1.1/?version=22.001.20.00.24"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --no-rate-limit "--database=C:\Users\X220\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel=m --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=51.0.2704.103 --handshake-handle=0xe4
"C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe" -Embedding
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --enable-features=AutomaticTabDiscarding<AutomaticTabDiscarding,IncidentReportingModuleLoadAnalysis<SafeBrowsingIncidentReportingServiceFeatures,IncidentReportingSuspiciousModuleReporting<SafeBrowsingIncidentReportingServiceFeatures,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup,UsePasswordSeparatedSigninFlow<PasswordSeparatedSigninFlow,WebFontsIntervention<WebFontsIntervention,*WebRTC-EnableWebRtcEcdsa<WebRTC-EnableWebRtcEcdsa,brotli-encoding<BrotliEncoding --disable-features=DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,RenderingPipelineThrottling<RenderingPipelineThrottling --force-fieldtrials=AppBannerTriggering/Aggressive/AutofillProfileOrderByFrecency/Enabled/AutomaticTabDiscarding/Enabled_Once_10-gen2/*BrotliEncoding/Enabled/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ClientSideDetectionModel/Model0/*DefaultBrowserInfobar/Default/DirectWriteFontProxy/UseDirectWriteFontProxy/DisallowFetchForDocWrittenScriptsInMainFrame/Default/EnableMediaRouter/Disabled/ExtensionActionRedesign/Enabled/ExtensionDeveloperModeWarning/Enabled/*GFE/Default/GoogleBrandedContextMenu/default/InstanceID/Enabled/MaterialDesignDownloads/Enabled/*NetworkQualityEstimator/Enabled/OmniboxBundledExperimentV1/Unused_2/OutOfProcessPac/Default/PasswordBranding/Disabled/*PasswordGeneration/Disabled/PasswordManagerSettingsMigration/Disable/PasswordSeparatedSigninFlow/Enabled/PreRead/Default/*QUIC/FlagDisabled/RenderingPipelineThrottling/Disabled/ReportCertificateErrors/ShowAndPossiblySend/ResourcePriorities/Launch50Permanent_11011_1_1_10/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/SafeBrowsingIncidentReportingService/Default/SafeBrowsingIncidentReportingServiceFeatures/WithSuspiciousModuleReporting/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SafeBrowsingUpdateFrequency/Default/SyncHttpContentCompression/Enabled/TriggeredResetFieldTrial/On/*UMA-Dynamic-Uniformity-Trial/Group3/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_19/*UMA-Uniformity-Trial-10-Percent/group_06/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_02/*UMA-Uniformity-Trial-5-Percent/group_10/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/WebFontsIntervention/Enabled/WebRTC-EnableWebRtcEcdsa/Default/ --type=gpu-process --channel="4424.0.1208001060\559638518" --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=4,12,13,25,46,54 --gpu-vendor-id=0x8086 --gpu-device-id=0x0126 --gpu-driver-vendor="Intel Corporation" --gpu-driver-version=9.17.10.2843 --mojo-platform-channel-handle=1224 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-features=AutomaticTabDiscarding<AutomaticTabDiscarding,IncidentReportingModuleLoadAnalysis<SafeBrowsingIncidentReportingServiceFeatures,IncidentReportingSuspiciousModuleReporting<SafeBrowsingIncidentReportingServiceFeatures,UpdateRendererPriorityOnStartup<UpdateRendererPriorityOnStartup,UsePasswordSeparatedSigninFlow<PasswordSeparatedSigninFlow,WebFontsIntervention<WebFontsIntervention,*WebRTC-EnableWebRtcEcdsa<WebRTC-EnableWebRtcEcdsa,brotli-encoding<BrotliEncoding --disable-features=DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame,RenderingPipelineThrottling<RenderingPipelineThrottling --force-fieldtrials=AppBannerTriggering/Aggressive/AutofillProfileOrderByFrecency/Enabled/*AutomaticTabDiscarding/Enabled_Once_10-gen2/*BrotliEncoding/Enabled/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/*ClientSideDetectionModel/Model0/*DefaultBrowserInfobar/Default/DirectWriteFontProxy/UseDirectWriteFontProxy/DisallowFetchForDocWrittenScriptsInMainFrame/Default/*EnableMediaRouter/Disabled/*ExtensionActionRedesign/Enabled/ExtensionDeveloperModeWarning/Enabled/*GFE/Default/GoogleBrandedContextMenu/default/InstanceID/Enabled/MaterialDesignDownloads/Enabled/*NetworkQualityEstimator/Enabled/*OmniboxBundledExperimentV1/Unused_2/*OutOfProcessPac/Default/PasswordBranding/Disabled/*PasswordGeneration/Disabled/*PasswordManagerSettingsMigration/Disable/PasswordSeparatedSigninFlow/Enabled/PreRead/Default/*QUIC/FlagDisabled/RenderingPipelineThrottling/Disabled/ReportCertificateErrors/ShowAndPossiblySend/*ResourcePriorities/Launch50Permanent_11011_1_1_10/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Default/*SafeBrowsingIncidentReportingServiceFeatures/WithSuspiciousModuleReporting/SafeBrowsingUnverifiedDownloads/DisableByParameterMostSbTypes2/SafeBrowsingUpdateFrequency/Default/SyncHttpContentCompression/Enabled/*TriggeredResetFieldTrial/On/*UMA-Dynamic-Uniformity-Trial/Group3/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_19/*UMA-Uniformity-Trial-10-Percent/group_06/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_02/*UMA-Uniformity-Trial-5-Percent/group_10/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/WebFontsIntervention/Enabled/WebRTC-EnableWebRtcEcdsa/Default/ --primordial-pipe-token=76CF34A3A9643EF6000B96D270E44FD3 --lang=en-GB --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=fetchDeferLateScripts=true,fetchIncreaseFontPriority=true,fetchIncreasePriorities=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --channel="4424.1.188413607\1329067710" --mojo-platform-channel-handle=1976 /prefetch:1
"C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\\SRORest.exe"
"C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe" /IpNotifyInstance
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"C:\Windows\System32\TpShocks.exe"
"C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe"
"C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe"
"C:\Program Files\Lenovo\Password Manager\password_manager.exe"
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe"
"C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
"C:\Program Files (x86)\Lenovo\Password Manager\pwm_ie_helper_desktop.exe"
"C:\Program Files (x86)\Lenovo\Password Manager\password_manager.exe"
"C:\Windows\system32\GWX\GWX.exe"
C:\Windows\system32\sppsvc.exe
"C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe"
C:\Windows\servicing\TrustedInstaller.exe
"C:\Windows\SysWOW64\RunDll32.exe" "C:\Program Files\ThinkPad\Bluetooth Software\SysWOW64\BtMmHook.dll",SetAndWaitBtMmHook
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\GWX\GWXUX.exe -Embedding
"C:\Users\X220\Downloads\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\X220\AppData\Roaming\Mozilla\Firefox\Profiles\en0h23em.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 22.0.0.192 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\SysWOW64\Adobe\Director\np32dsw_1214154.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@bankid.com/BankID säkerhetsprogram,version=6.2.2.1]
"Description"=BankID säkerhetsprogram
"Path"=C:\Program Files (x86)\BankID\npBispBrowser.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@bankid.com/BankID säkerhetsprogram,version=6.2.5.1]
"Description"=BankID säkerhetsprogram
"Path"=C:\Program Files (x86)\BankID\npBispBrowser.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.25.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.25.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 22.0.0.192 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_192.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL


C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2010-01-21 6723984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-09 662672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-01-16 688528]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-05-27 163536]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-14 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-09 565304]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office15\URLREDIR.DLL [2014-01-22 707800]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL [2016-05-17 1741096]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-14 172968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"TpShocks"=C:\Windows\system32\TpShocks.exe [2014-02-17 384344]
"AcWin7Hlpr"=C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [2015-06-08 63728]
"LENOVO.TPKNRRES"=C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [2013-05-29 60920]
"ALCKRESI.EXE"=C:\Program Files\Lenovo\AutoLock\ALCKRESI.EXE [2013-04-15 388600]
"PasswordManager"=C:\Program Files\Lenovo\Password Manager\password_manager.exe [2014-06-23 1665824]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SAIICpl.exe [2010-12-14 316032]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2013-02-19 170304]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2013-02-19 398656]
"Persistence"=C:\Windows\system32\igfxpers.exe [2013-02-19 441152]
"IME14 CHS Uninstall"=C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 110776]
"IME14 KOR Uninstall"=C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 110776]
"IME14 JPN Uninstall"=C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 110776]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"GoogleChromeAutoLaunch_53D957690F7090EE22C9B2AAB3AEA4EE"=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [2016-06-15 941720]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"PWMTRV"=rundll32 C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL,PwrMgrBkGndMonitor []
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-05-12 5515496]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-01-21 91520]
"IME14 CHS Uninstall"=C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 81080]
"IME14 KOR Uninstall"=C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 81080]
"IME14 JPN Uninstall"=C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 81080]
"IME14 CHT Uninstall"=C:\Program Files (x86)\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE [2015-10-13 81080]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2013-02-19 441856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\wpdshserviceobj.dll [2010-11-21 115200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll [2009-05-12 275360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2010-01-21 6723984]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2016-06-23 13:04:48 ----HD---- C:\$GetCurrent
2016-06-23 13:04:44 ----D---- C:\Windows10Upgrade
2016-06-23 12:43:07 ----ASH---- C:\pagefile.sys
2016-06-23 12:43:04 ----ASH---- C:\hiberfil.sys
2016-06-23 10:21:28 ----D---- C:\Windows\pss
2016-06-22 17:04:21 ----D---- C:\Program Files (x86)\CleanUp!
2016-06-22 09:47:54 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2016-06-22 09:47:40 ----A---- C:\Windows\system32\drivers\mwac.sys
2016-06-22 09:47:40 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2016-06-22 09:47:40 ----A---- C:\Windows\system32\drivers\mbam.sys
2016-06-22 09:47:37 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-06-22 09:09:01 ----D---- C:\Program Files\BitTorrent
2016-06-22 09:08:43 ----A---- C:\Users\X220\AppData\Roaming\agent.dat
2016-06-22 09:08:24 ----A---- C:\Users\X220\AppData\Roaming\Installer.dat
2016-06-22 09:08:02 ----D---- C:\Program Files (x86)\KMSPico 10.0.6
2016-06-21 11:36:30 ----D---- C:\Program Files (x86)\Microsoft Synchronization Services
2016-06-21 11:36:18 ----D---- C:\Windows\PCHEALTH
2016-06-21 11:36:18 ----D---- C:\Program Files (x86)\Microsoft Sync Framework
2016-06-21 11:36:18 ----D---- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2016-06-19 10:26:55 ----SHD---- C:\$RECYCLE.BIN
2016-06-19 10:26:02 ----A---- C:\ComboFix.txt
2016-06-19 09:19:39 ----D---- C:\Program Files (x86)\mpck
2016-06-19 08:59:51 ----D---- C:\Users\X220\AppData\Roaming\Profiles
2016-06-19 08:59:50 ----D---- C:\Program Files (x86)\Phakichreenash
2016-06-17 23:28:33 ----D---- C:\KVRT_Data
2016-06-17 09:30:18 ----D---- C:\Windows\rescache
2016-06-17 08:02:33 ----D---- C:\ProgramData\Malwarebytes
2016-06-16 15:17:49 ----D---- C:\Windows\temp
2016-06-16 13:43:13 ----A---- C:\Windows\NIRCMD.exe
2016-06-16 12:26:55 ----A---- C:\Windows\zip.exe
2016-06-16 12:26:55 ----A---- C:\Windows\SWSC.exe
2016-06-16 12:26:55 ----A---- C:\Windows\SWREG.exe
2016-06-16 12:26:55 ----A---- C:\Windows\sed.exe
2016-06-16 12:26:55 ----A---- C:\Windows\PEV.exe
2016-06-16 12:26:55 ----A---- C:\Windows\MBR.exe
2016-06-16 12:26:55 ----A---- C:\Windows\grep.exe
2016-06-16 12:26:35 ----D---- C:\Qoobox
2016-06-16 11:46:39 ----A---- C:\Windows\SYSWOW64\tzres.dll
2016-06-16 11:46:39 ----A---- C:\Windows\system32\tzres.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\secur32.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\schannel.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\credssp.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\certcli.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\bcryptprimitives.dll
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2016-06-16 11:46:38 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\wdigest.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\TSpkg.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\sspisrv.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\sspicli.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\secur32.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\schannel.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\rpcrt4.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\rpchttp.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\ncrypt.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\msv1_0.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\msobjs.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\msaudite.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\lsass.exe
2016-06-16 11:46:38 ----A---- C:\Windows\system32\lsasrv.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\kerberos.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\srvnet.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\srv2.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\srv.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\drivers\cng.sys
2016-06-16 11:46:38 ----A---- C:\Windows\system32\cryptbase.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\credssp.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\certcli.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\bcryptprimitives.dll
2016-06-16 11:46:38 ----A---- C:\Windows\system32\auditpol.exe
2016-06-16 11:46:38 ----A---- C:\Windows\system32\adtschema.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\lpk.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2016-06-16 11:46:37 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\lpk.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\fontsub.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\dciman32.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\atmlib.dll
2016-06-16 11:46:37 ----A---- C:\Windows\system32\atmfd.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\ws2_32.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\winipsec.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\winhttp.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\StructuredQuery.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\polstore.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\netbtugc.exe
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\mswsock.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\gpscript.exe
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\gpscript.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\gpprefcl.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\gpapi.dll
2016-06-16 11:46:36 ----A---- C:\Windows\SYSWOW64\FwRemoteSvr.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\ws2_32.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\winipsec.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\winhttp.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\win32k.sys
2016-06-16 11:46:36 ----A---- C:\Windows\system32\StructuredQuery.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\polstore.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\netbtugc.exe
2016-06-16 11:46:36 ----A---- C:\Windows\system32\mswsock.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\IPSECSVC.DLL
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpsvc.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpscript.exe
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpscript.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpprefcl.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\gpapi.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2016-06-16 11:46:36 ----A---- C:\Windows\system32\drivers\netbt.sys
2016-06-16 11:46:35 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2016-06-16 11:46:35 ----A---- C:\Windows\system32\gdi32.dll
2016-06-16 11:46:34 ----A---- C:\Windows\SYSWOW64\webio.dll
2016-06-16 11:46:34 ----A---- C:\Windows\system32\webio.dll
2016-06-16 11:46:32 ----A---- C:\Windows\SYSWOW64\shell32.dll
2016-06-16 11:46:32 ----A---- C:\Windows\SYSWOW64\explorer.exe
2016-06-16 11:46:32 ----A---- C:\Windows\system32\shell32.dll
2016-06-16 11:46:32 ----A---- C:\Windows\system32\ExplorerFrame.dll
2016-06-16 11:46:32 ----A---- C:\Windows\explorer.exe
2016-06-16 11:46:31 ----A---- C:\Windows\SYSWOW64\ExplorerFrame.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\invagent.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\generaltel.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\devinv.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\CompatTelRunner.exe
2016-06-16 11:44:06 ----A---- C:\Windows\system32\centel.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\appraiser.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\aeinv.dll
2016-06-16 11:44:06 ----A---- C:\Windows\system32\acmigration.dll
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\msimsg.dll
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\msiexec.exe
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\msi.dll
2016-06-16 11:44:00 ----A---- C:\Windows\SYSWOW64\authui.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\msimsg.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\msihnd.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\msiexec.exe
2016-06-16 11:44:00 ----A---- C:\Windows\system32\msi.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\consent.exe
2016-06-16 11:44:00 ----A---- C:\Windows\system32\authui.dll
2016-06-16 11:44:00 ----A---- C:\Windows\system32\appinfo.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\occache.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\inseng.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2016-06-16 11:43:57 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\inseng.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\iernonce.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\ieetwproxystub.dll
2016-06-16 11:43:57 ----A---- C:\Windows\system32\ieetwcollector.exe
2016-06-16 11:43:57 ----A---- C:\Windows\system32\ie4uinit.exe
2016-06-16 11:43:56 ----A---- C:\Windows\SYSWOW64\jscript.dll
2016-06-16 11:43:56 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2016-06-16 11:43:56 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2016-06-16 11:43:56 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2016-06-16 11:43:56 ----A---- C:\Windows\system32\urlmon.dll
2016-06-16 11:43:56 ----A---- C:\Windows\system32\occache.dll
2016-06-16 11:43:56 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2016-06-16 11:43:56 ----A---- C:\Windows\system32\iedkcs32.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\ieui.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2016-06-16 11:43:55 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2016-06-16 11:43:55 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2016-06-16 11:43:55 ----A---- C:\Windows\system32\msfeeds.dll
2016-06-16 11:43:55 ----A---- C:\Windows\system32\iesetup.dll
2016-06-16 11:43:55 ----A---- C:\Windows\system32\ieapfltr.dll
2016-06-16 11:43:55 ----A---- C:\Windows\system32\dxtrans.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\wininet.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\msrating.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2016-06-16 11:43:54 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2016-06-16 11:43:54 ----A---- C:\Windows\system32\vbscript.dll
2016-06-16 11:43:54 ----A---- C:\Windows\system32\jsproxy.dll
2016-06-16 11:43:54 ----A---- C:\Windows\system32\iertutil.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\mshtmlmedia.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\mshtmled.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\ieui.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\ieframe.dll
2016-06-16 11:43:53 ----A---- C:\Windows\system32\dxtmsft.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\wininet.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\webcheck.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\jscript9diag.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\jscript9.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\jscript.dll
2016-06-16 11:43:52 ----A---- C:\Windows\system32\ieUnatt.exe
2016-06-16 11:43:51 ----A---- C:\Windows\system32\msrating.dll
2016-06-16 11:43:51 ----A---- C:\Windows\system32\MshtmlDac.dll
2016-06-16 11:43:51 ----A---- C:\Windows\system32\mshtml.dll
2016-05-31 09:57:17 ----D---- C:\Users\X220\AppData\Roaming\webex
2016-05-31 09:56:25 ----D---- C:\ProgramData\WebEx

======List of files/folders modified in the last 1 month======

2016-06-23 22:41:44 ----D---- C:\Windows
2016-06-23 18:11:14 ----D---- C:\Program Files\trend micro
2016-06-23 18:10:42 ----D---- C:\Windows\system32\config
2016-06-23 18:03:07 ----D---- C:\Windows\System32
2016-06-23 18:03:07 ----A---- C:\Windows\system32\PerfStringBackup.INI
2016-06-23 18:01:40 ----D---- C:\Windows\Tasks
2016-06-23 15:27:20 ----SHD---- C:\System Volume Information
2016-06-23 14:02:47 ----D---- C:\Windows\winsxs
2016-06-23 14:02:08 ----D---- C:\Windows\system32\catroot2
2016-06-23 13:52:56 ----D---- C:\AdwCleaner
2016-06-23 12:43:13 ----HD---- C:\$WINDOWS.~BT
2016-06-23 12:24:58 ----D---- C:\Windows\registration
2016-06-23 12:21:36 ----D---- C:\Windows\Panther
2016-06-23 10:09:57 ----A---- C:\Windows\ntbtlog.txt
2016-06-23 07:44:13 ----D---- C:\Program Files\Microsoft Silverlight
2016-06-23 07:44:13 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2016-06-23 01:12:11 ----SHD---- C:\Windows\Installer
2016-06-23 01:12:11 ----D---- C:\Config.Msi
2016-06-22 22:03:01 ----D---- C:\Windows\system32\drivers
2016-06-22 17:04:21 ----RD---- C:\Program Files (x86)
2016-06-22 16:53:02 ----D---- C:\Windows\SysWOW64
2016-06-22 16:53:02 ----D---- C:\Windows\system32\Tasks
2016-06-22 16:53:02 ----D---- C:\ProgramData
2016-06-22 09:41:35 ----RD---- C:\Program Files
2016-06-22 09:41:04 ----D---- C:\Users\X220\AppData\Roaming\uTorrent
2016-06-22 09:24:07 ----D---- C:\Program Files (x86)\Common Files
2016-06-21 15:40:25 ----D---- C:\Program Files\Common Files\Microsoft Shared
2016-06-21 15:09:39 ----D---- C:\Windows\Logs
2016-06-21 14:03:15 ----D---- C:\ProgramData\Microsoft Help
2016-06-21 13:19:37 ----A---- C:\Windows\win.ini
2016-06-21 12:52:24 ----D---- C:\Windows\Microsoft.NET
2016-06-21 12:52:23 ----RSD---- C:\Windows\assembly
2016-06-21 11:53:29 ----D---- C:\Windows\AutoKMS
2016-06-21 11:36:47 ----RSD---- C:\Windows\Fonts
2016-06-21 11:36:39 ----D---- C:\Program Files (x86)\MSBuild
2016-06-21 11:36:30 ----D---- C:\Windows\ShellNew
2016-06-21 11:36:18 ----SD---- C:\ProgramData\Microsoft
2016-06-21 11:36:18 ----D---- C:\Program Files (x86)\Microsoft.NET
2016-06-21 11:36:18 ----D---- C:\Program Files (x86)\Microsoft Office
2016-06-21 11:35:43 ----D---- C:\Windows\system32\wbem
2016-06-21 11:35:33 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 8
2016-06-21 11:35:25 ----D---- C:\Program Files\Microsoft Office
2016-06-20 23:17:48 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2016-06-20 23:17:46 ----D---- C:\Program Files\Common Files
2016-06-20 16:41:23 ----SD---- C:\Users\X220\AppData\Roaming\Microsoft
2016-06-19 21:57:31 ----D---- C:\Windows\system32\FxsTmp
2016-06-19 10:11:04 ----A---- C:\Windows\system.ini
2016-06-19 09:54:16 ----D---- C:\Windows\SYSWOW64\drivers
2016-06-19 09:54:16 ----D---- C:\Windows\AppPatch
2016-06-18 20:02:19 ----D---- C:\Users\X220\AppData\Roaming\Skype
2016-06-18 15:04:07 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2016-06-18 14:29:25 ----D---- C:\Windows\system32\NDF
2016-06-17 13:44:58 ----D---- C:\Users\X220\AppData\Roaming\Lenovo
2016-06-17 08:48:17 ----D---- C:\Windows\CSC
2016-06-17 08:39:25 ----D---- C:\Users\X220\AppData\Roaming\rmi
2016-06-17 07:59:13 ----D---- C:\Program Files (x86)\Lenovo
2016-06-17 07:58:52 ----D---- C:\ProgramData\Lenovo
2016-06-17 07:47:53 ----D---- C:\Windows\SYSWOW64\sv-SE
2016-06-17 07:47:53 ----D---- C:\Windows\SYSWOW64\en-US
2016-06-17 07:47:53 ----D---- C:\Windows\system32\sv-SE
2016-06-17 07:47:53 ----D---- C:\Windows\system32\en-US
2016-06-17 07:47:53 ----D---- C:\Windows\system32\appraiser
2016-06-17 07:47:52 ----D---- C:\Windows\sv-SE
2016-06-17 07:47:52 ----D---- C:\Windows\en-US
2016-06-17 07:47:52 ----D---- C:\Program Files\Internet Explorer
2016-06-17 07:47:51 ----D---- C:\Program Files (x86)\Internet Explorer
2016-06-16 15:18:23 ----D---- C:\Windows\system32\drivers\etc
2016-06-16 15:17:58 ----D---- C:\Windows\system32\catroot
2016-06-16 15:17:53 ----D---- C:\Windows\erdnt
2016-06-15 16:55:55 ----D---- C:\Windows\inf
2016-06-13 19:31:06 ----N---- C:\Windows\system32\MpSigStub.exe
2016-06-01 11:20:37 ----D---- C:\ProgramData\Skype
2016-06-01 11:20:31 ----RD---- C:\Program Files (x86)\Skype
2016-05-30 09:36:17 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2016-05-30 09:36:17 ----D---- C:\Program Files (x86)\Mozilla Firefox
2016-05-27 06:15:25 ----SD---- C:\Windows\SYSWOW64\GWX
2016-05-27 06:15:25 ----SD---- C:\Windows\system32\GWX

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2015-04-30 65736]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2015-04-30 272248]
R0 DzHDD64;DzHDD64; C:\Windows\System32\DRIVERS\DzHDD64.sys [2016-04-14 29512]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2012-05-30 569152]
R0 iaStorA;iaStorA; C:\Windows\system32\DRIVERS\iaStorA.sys [2014-11-13 652784]
R0 iaStorF;iaStorF; C:\Windows\system32\DRIVERS\iaStorF.sys [2014-11-13 28656]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 Shockprf;Shockprf; C:\Windows\System32\DRIVERS\Apsx64.sys [2014-01-29 152888]
R0 TPDIGIMN;TPDIGIMN; C:\Windows\System32\DRIVERS\ApsHM64.sys [2014-01-29 29496]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2015-04-30 93528]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2015-04-30 1047320]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2015-06-27 442264]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiifx64.sys [2013-05-22 15472]
R1 TPPWRIF;TPPWRIF; C:\Windows\System32\drivers\Tppwr64v.sys [2016-04-14 29008]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2015-04-30 29168]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2015-04-30 89944]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2015-04-30 137288]
R2 risdxc;risdxc; C:\Windows\system32\DRIVERS\risdxc64.sys [2014-10-27 101888]
R3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2014-10-27 166016]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2014-10-27 1580704]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2014-06-27 495376]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2015-05-12 63464]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2013-02-19 9000256]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2015-01-30 342528]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2016-03-10 27008]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2014-10-27 125952]
R3 NAL;Nal Service ; \??\C:\Windows\system32\Drivers\iqvw64e.sys [2015-02-12 34568]
R3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit; C:\Windows\system32\DRIVERS\NETwsw01.sys [2014-12-19 11523584]
R3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2014-07-28 45296]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2014-07-28 461552]
R3 TPM;TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
R3 usb_rndisx;USB RNDIS Adapter; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-06-29 19968]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 b06diag;Broadcom NetXtreme II Diag Driver; C:\Windows\system32\drivers\bxdiaga.sys [2012-03-08 88104]
S3 BFN7x64;Bigfoot Networks Killer Gaming Service; C:\Windows\system32\drivers\Xeno7x64.sys [2012-02-22 157288]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2013-06-29 552960]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2013-06-29 80384]
S3 btwampfl;btwampfl Bluetooth filter driver; \??\C:\Windows\system32\drivers\btwampfl.sys [2012-12-04 598808]
S3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2012-05-02 184144]
S3 btwavdt;Bluetooth AVDT; C:\Windows\system32\DRIVERS\btwavdt.sys [2012-03-06 210984]
S3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2011-09-18 39976]
S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2012-03-06 21544]
S3 bxfcoe;bxfcoe; C:\Windows\system32\drivers\bxfcoe.sys [2012-02-22 178216]
S3 bxois;bxois; C:\Windows\system32\drivers\bxois.sys [2012-02-22 539176]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 cpuz134;cpuz134; \??\C:\Users\X220\AppData\Local\Temp\cpuz134\cpuz134_x64.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 ioatdma1;ioatdma1; C:\Windows\System32\Drivers\qd162x64.sys [2009-11-16 40144]
S3 ioatdma2;Intel(R) QuickData Technology device ver.2; C:\Windows\System32\Drivers\qd262x64.sys [2009-11-16 42192]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2016-06-22 192216]
S3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2016-03-10 64896]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2013-06-29 19456]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [2010-11-21 88960]
S3 Tdsshbecr;Handelsbanken card reader; C:\Windows\system32\DRIVERS\shbecr.sys [2008-09-28 50176]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2013-06-29 29696]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2013-06-29 30208]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcPrfMgrSvc;AcPrfMgrSvc; C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe [2015-06-08 133360]
R2 AcSvc;AcSvc; C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe [2015-06-08 276720]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2016-04-22 82128]
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-04-30 343336]
R2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe [2013-05-14 1008344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2010-12-17 198784]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04); C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [2014-11-19 151648]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2014-11-19 638368]
R2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2015-05-12 102376]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2015-02-12 262920]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute; C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [2013-05-29 44024]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-05-27 110128]
R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction; C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2013-05-29 62456]
R2 Mobile Broadband HL Service;Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [2013-01-28 239184]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2014-11-19 157088]
R2 SAService;Conexant SmartAudio service; C:\Windows\system32\SAsrv.exe []
R2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2016-03-23 327808]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 125424]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2014-05-27 125488]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2012-04-24 169752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2015-11-05 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2015-11-05 125112]
S2 gupdate;Tjänsten Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-05 144200]
S2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2016-03-10 1136608]
S2 SROSVC;Screen Reading Optimizer Service Program; C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe [2012-03-05 446800]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-06-18 270016]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2015-11-05 51376]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2013-02-19 276288]
S3 DozeSvc;Lenovo Doze Mode Service; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2016-04-14 326160]
S3 gupdatem;Tjänsten Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-05 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2016-05-20 114688]
S3 LSC.Services.SystemService;Lenovo Solution Center System Service; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe [2016-04-20 273232]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2016-05-23 146888]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2014-11-19 268192]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2014-01-23 178760]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 5132888]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 Power Manager DBC Service;Power Manager Service; C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2016-04-14 1668776]
S3 ShareItSvc;ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [2016-01-20 31176]
S3 SUService;System Update; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [2016-05-25 21536]
S3 TPHDEXLGSVC;ThinkPad HDD APS Logging Service; C:\Windows\System32\TPHDEXLG64.exe [2014-01-29 49976]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-06-29 1255736]
S4 BitTorrent;BitTorrent; C:\Program Files\BitTorrent\BitTorrent.exe [2016-06-22 383488]
S4 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2016-03-10 1514464]
S4 NetMsmqActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetPipeActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetTcpActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]

-----------------EOF-----------------

Re: prosim o kontrolu

Napsal: 23 čer 2016 18:02
od Rudy
Jj, my ho tu používáme. Ale pouze pod dozorem rádce a na jeho pokyn. Smazáno. Nastala nějaká změna?

Re: prosim o kontrolu

Napsal: 23 čer 2016 19:17
od Blanka yahoo
nereaguje mi vubec na restart, shut down atd., ostatni strasne dlouhe odezvy
videla jsem jeste nejake divne "soubory" pod notification, kterym nerozumim jako napr. daikywiki, PCSUN notifier, KMSpico

nemam instalacky a klic k puvodnim Wind 7, nebot jsem koupila laptop jako sekac a nic k tomu nebylo
co by jste doporucil?
pokousela jsem se upg z wind 7 na wind 10, ale to vubec neslo...?
obcas se objeti Wind explorer stopped working, a taky ma u svoji ikony cerveny krizek....

fakt si nevim rady, dekuji

Re: prosim o kontrolu

Napsal: 23 čer 2016 19:25
od Rudy
Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

Re: prosim o kontrolu

Napsal: 23 čer 2016 20:33
od Blanka yahoo
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2016-06-23
Scan Time: 20:52
Logfile: mbam.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.02.16.06
Rootkit Database: v2016.02.08.01
License: Trial
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: X220

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 377199
Time Elapsed: 36 min, 46 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

Re: prosim o kontrolu

Napsal: 23 čer 2016 20:40
od Blanka yahoo
jeste se zeptam, zda je by mohlo byt resenim upg z win 7 na 10?
pokud ano, proc mi to nejde. davam mi to odpoved, ze nemam dost pamati, ale te mam docela dost?

Re: prosim o kontrolu

Napsal: 23 čer 2016 21:17
od Rudy
Na disku zbývá 22GB volného místa. Pro desítky to nemusí stačit. Původní adresář windows na disku zůstane (pouze bude přejmenován) a vytvoří se nový s desítkami. V tom je asi ten problém.

Re: prosim o kontrolu

Napsal: 23 čer 2016 21:56
od Blanka yahoo
a doporucite mi prechod na desitky? vyresi muj problem? neboli se jevi, ze stavajici sedmicky jsou poskozene a ja je nemohu preinstalovat...? nebo je to jeste neco jineho?

Re: prosim o kontrolu

Napsal: 24 čer 2016 06:43
od Rudy
Tak přechod na desítky by mohl problém vyřešit (jestli opravdu, nevím, musel bych být jasnovidec). Otázka zní, co s těmi daty, když vám instalátor hlásí, že se instalace na disk nevejde.
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz