VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Prosim o preventinvku. Dik.

https://forum.viry.cz:443/viewtopic.php?t=150304

Stránka 1 z 1

Prosim o preventinvku. Dik.

Napsal: 16 říj 2016 19:50
od peter19500
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-10-2016
Ran by ntb (administrator) on NTB-PC (16-10-2016 20:03:25)
Running from C:\Users\ntb\Desktop
Loaded Profiles: ntb & DefaultAppPool (Available Profiles: ntb & DefaultAppPool)
Platform: Windows 10 Home Version 1511 (X64) Language: Slovenčina (Slovensko)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(ActivIdentity) C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\AMT\LMS.exe
() C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Intel Corporation) C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Microsoft) C:\Program Files\WindowsApps\Microsoft.BingFinance_4.16.19.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Money.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.81\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.81\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.81\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.81\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.81\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.81\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.81\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.81\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.81\opera.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(forum.viry.cz) C:\Users\ntb\Desktop\FRSTLauncher1.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.81\opera.exe


==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-03] (Synaptics Incorporated)
HKLM\...\Run: [picon] => C:\Program Files (x86)\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe [358936 2009-07-15] (Intel Corporation)
HKLM\...\Run: [SoundMAX] => C:\Program Files (x86)\Analog Devices\SoundMAX\soundmax.exe [3866624 2009-05-18] (Analog Devices, Inc.)
HKLM\...\Run: [acevents] => C:\Program Files\ActivIdentity\ActivClient\acevents.exe [196648 2009-06-03] (ActivIdentity)
HKLM\...\Run: [accrdsub] => C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [483880 2009-06-03] (ActivIdentity)
HKLM-x32\...\Run: [SoundMAXPnP] => C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1314816 2009-05-18] (Analog Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [917584 2016-10-10] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1298504 2014-11-08] (CANON INC.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [318248 2016-01-08] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [60136 2016-08-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [598552 2016-06-22] (Oracle Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [KiesPDLR.exe] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1021736 2016-01-08] (Samsung)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1572648 2016-01-08] (Samsung)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2007-06-27] (Nero AG)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-07-13] (TomTom)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [Free Download Manager] => C:\Program Files (x86)\Free Download Manager\fdm.exe [5717584 2015-10-28] (FreeDownloadManager.ORG)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6851288 2016-07-13] (Piriform Ltd)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [1790616 2016-10-10] (Lavasoft)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {097d7b58-19bb-11e6-9be4-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {2a3524f6-649d-11e6-9bef-18a90581b1a5} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {62218dd4-7ac3-11e6-9bf3-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {6221977a-7ac3-11e6-9bf3-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {622197ea-7ac3-11e6-9bf3-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {6221a3cf-7ac3-11e6-9bf3-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {7433da79-3dfd-11e6-9be8-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {8f78a5e9-e15c-11e5-9bdf-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {8f78ab60-e15c-11e5-9bdf-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {8f78adb9-e15c-11e5-9bdf-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {8f78af05-e15c-11e5-9bdf-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {a221ce63-f6a1-11e5-9be2-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {a6f8379f-7ab5-11e6-9bf1-00247eee44a0} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517632 2015-10-30] (Microsoft Corporation)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64\FileSyncShell64.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64\FileSyncShell64.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64\FileSyncShell64.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncShell.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncShell.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncShell.dll [2015-12-24] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog9 01 C:\WINDOWS\system32\LavasoftTcpService.dll No File
Winsock: Catalog9 02 C:\WINDOWS\system32\LavasoftTcpService.dll No File
Winsock: Catalog9 03 C:\WINDOWS\system32\LavasoftTcpService.dll No File
Winsock: Catalog9 04 C:\WINDOWS\system32\LavasoftTcpService.dll No File
Winsock: Catalog9 17 C:\WINDOWS\system32\LavasoftTcpService.dll No File
Winsock: Catalog9-x64 01 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2016-09-27] (Lavasoft Limited)
Winsock: Catalog9-x64 02 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2016-09-27] (Lavasoft Limited)
Winsock: Catalog9-x64 03 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2016-09-27] (Lavasoft Limited)
Winsock: Catalog9-x64 04 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2016-09-27] (Lavasoft Limited)
Winsock: Catalog9-x64 17 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2016-09-27] (Lavasoft Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{4ebd6ac1-c602-411d-acb8-a0fe61a9414f}: [DhcpNameServer] 192.168.2.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131208505197382864&GUID=3114ABCA-E2DE-4105-A3E8-C1669E4C763F
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131208505197624020&GUID=3114ABCA-E2DE-4105-A3E8-C1669E4C763F
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131208505197629640&GUID=3114ABCA-E2DE-4105-A3E8-C1669E4C763F
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> 12618F81508237FF74E655DBBAE976EF URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> {2DC90D8C-5E7D-491E-8E9D-FCF17A803778} URL = hxxp://yandex.com/yandsearch?win=160&clid=1989596&text={searchTerms}
SearchScopes: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = hxxps://search.yahoo.com/search?fr=vmn&type=vmn__webcompa__1_0__ya__ch_WCYID10270__160927__yaie&p={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_101\bin\ssv.dll [2016-08-06] (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-06] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-08-06] (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll [2015-10-28] (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-06] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} - No File
DPF: HKLM-x32 {62789780-B744-11D0-986B-00609731A21D} hxxp://195.28.70.134/kapor2/lib/mgaxctrl.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\ntb\AppData\Roaming\TomTom\HOME\Profiles\4xvsx4bf.default [2015-12-02]
FF Extension: (Map status indicator) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [2015-12-01] [not signed]
FF ProfilePath: C:\Users\ntb\AppData\Roaming\Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457 [2016-10-16]
FF NewTab: Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457 -> hxxps://www.yahoo.com/?fr=vmn&type=vmn__webcomp ... 0927__yaff
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457 -> Yahoo®
FF Homepage: Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457 -> hxxps://www.google.sk/
FF Extension: (FirefixTab) - C:\Users\ntb\AppData\Roaming\Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457\Extensions\deskCutv2@gmail.com [2016-01-19] [not signed]
FF Extension: (Flash and Video Download) - C:\Users\ntb\AppData\Roaming\Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2016-10-10]
FF SearchPlugin: C:\Users\ntb\AppData\Roaming\Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457\searchplugins\yahoo-lavasoft.xml [2016-09-27]
FF Extension: (Skype) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-05-25]
FF HKLM-x32\...\Firefox\Extensions: [yahooprotected@gmail.com] - C:\Users\ntb\AppData\Roaming\Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457\extensions\yahooprotected@gmail.com => not found
FF HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Firefox\Extensions: [fdm_ffext@freedownloadmanager.org] - C:\ProgramData\Free Download Manager\Firefox\Extensions\2.1.1
FF Extension: (Free Download Manager extension) - C:\ProgramData\Free Download Manager\Firefox\Extensions\2.1.1 [2016-01-31]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_23_0_0_185.dll [2016-10-12] ()
FF Plugin: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-06] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-06] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_185.dll [2016-10-12] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-06] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-06] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cncgohepihcekklokhbhiblhfcmipbdh] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gehngeifmelphpllncobkmimphfkckne] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pchfckkccldkbclgdepkaonamkignanh] - hxxp://clients2.google.com/service/update2/crx

Opera:
=======
OPR Extension: (MediaPlus) - C:\Users\ntb\AppData\Roaming\Opera Software\Opera Stable\Extensions\fpnoagnjlblajeghmbaejnfhekofbecd [2015-12-11]
OPR Extension: (Youtube to mp3 converter) - C:\Users\ntb\AppData\Roaming\Opera Software\Opera Stable\Extensions\geioidjhliialbjcekeejcodiahfplgb [2014-06-01]
OPR Extension: (YouTube Downloader) - C:\Users\ntb\AppData\Roaming\Opera Software\Opera Stable\Extensions\kclijeogghhkmenkommbnjobhnndpfba [2015-11-16]
OPR Extension: (FVD Video Downloader) - C:\Users\ntb\AppData\Roaming\Opera Software\Opera Stable\Extensions\neacgcjokggofibnbfapeaejhclmpple [2016-09-25]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ac.sharedstore; C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe [277032 2009-06-03] (ActivIdentity)
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [1086040 2016-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [475232 2016-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [475232 2016-10-10] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1489240 2016-10-10] (Avira Operations GmbH & Co. KG)
S2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [324304 2016-08-19] (Avira Operations GmbH & Co. KG)
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1364096 2016-05-25] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1687680 2016-05-25] (Microsoft Corporation)
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [192200 2016-08-26] ()
S2 LavasoftTcpService; C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.4.7\LavasoftTcpService.exe [2751760 2016-10-10] (Lavasoft Limited)
R2 LMS; C:\Program Files (x86)\Intel\AMT\LMS.exe [174616 2009-07-15] (Intel Corporation)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [279848 2007-06-27] (Nero AG)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.)
R2 UNS; C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2058776 2009-07-15] (Intel Corporation)
S3 vmicvss; C:\Windows\System32\ICSvc.dll [511488 2016-09-07] (Microsoft Corporation)
S2 WCAssistantService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe [25240 2016-10-10] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364456 2016-09-07] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-09-07] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [149832 2016-10-10] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-29] (AVG Technologies)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [153392 2016-10-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [35488 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [78208 2016-05-14] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R3 BTHprint; C:\Windows\system32\DRIVERS\bthprint.sys [65536 2015-10-30] (Microsoft Corporation)
S3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-07-12] (Disc Soft Ltd)
R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R3 ElbyCDFL; C:\Windows\SysWOW64\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R3 HBtnKey; C:\Windows\system32\DRIVERS\cpqbttn.sys [19000 2010-02-25] (Hewlett-Packard Company)
S3 HWHandSet; C:\Windows\system32\DRIVERS\hw_quusbmdm.sys [223232 2016-05-25] (Huawei Technologies Co., Ltd.)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2016-05-25] (Huawei Technologies Co., Ltd.)
R3 rismcx64; C:\Windows\system32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.)
S3 ssceserd; C:\Windows\system32\DRIVERS\ssceserd.sys [158024 2015-05-21] (MCCI Corporation)
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [113952 2014-02-25] (Oracle Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
U3 idsvc; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-10-16 20:03 - 2016-10-16 20:03 - 00025301 _____ C:\Users\ntb\Desktop\FRST.txt
2016-10-16 20:01 - 2016-10-16 20:03 - 00000000 ____D C:\FRST
2016-10-16 19:52 - 2016-10-16 20:01 - 00112640 _____ (forum.viry.cz) C:\Users\ntb\Desktop\FRSTLauncher1.exe
2016-10-16 19:40 - 2016-10-16 19:40 - 00112640 _____ (forum.viry.cz) C:\Users\ntb\Desktop\FRSTLauncher
2016-10-16 19:30 - 2016-10-16 19:30 - 02406912 _____ (Farbar) C:\Users\ntb\Desktop\FRST64.exe
2016-10-16 15:52 - 2016-10-16 15:52 - 00001090 _____ C:\Users\Public\Desktop\NEF to JPG.lnk
2016-10-16 15:52 - 2016-10-16 15:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NEF to JPG
2016-10-16 15:52 - 2016-10-16 15:52 - 00000000 ____D C:\Program Files (x86)\NEF to JPG
2016-10-16 15:51 - 2016-10-16 15:52 - 01412765 _____ (neftojpg.com ) C:\Users\ntb\Downloads\neftojpg_setup.exe
2016-10-12 16:43 - 2016-10-16 15:43 - 20478656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2016-10-10 18:53 - 2016-10-10 18:53 - 00016629 _____ C:\Users\ntb\Desktop\Faktúra DH 20160009.odt
2016-10-10 18:08 - 2016-10-10 18:06 - 00023640 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avusbflt.sys
2016-10-05 17:53 - 2016-10-05 17:54 - 04518690 _____ C:\Users\ntb\Downloads\DD06.tmp
2016-10-05 17:52 - 2016-10-05 17:52 - 00000020 ___SH C:\Users\DefaultAppPool\ntuser.ini
2016-10-01 07:12 - 2016-10-05 17:58 - 00000000 ____D C:\WINDOWS\Panther
2016-09-27 18:54 - 2016-09-27 18:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOM
2016-09-27 18:52 - 2016-10-10 18:15 - 00002952 _____ C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini
2016-09-27 18:52 - 2016-10-10 18:15 - 00002952 _____ C:\WINDOWS\system32\LavasoftTcpServiceOff.ini
2016-09-27 18:52 - 2016-09-27 18:52 - 00425744 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll
2016-09-27 18:52 - 2016-09-27 18:52 - 00345360 _____ (Lavasoft Limited) C:\WINDOWS\SysWOW64\LavasoftTcpService.dll
2016-09-27 18:52 - 2016-09-27 18:52 - 00000000 ____D C:\Users\ntb\AppData\Roaming\Lavasoft
2016-09-27 18:52 - 2016-09-27 18:52 - 00000000 ____D C:\Users\ntb\AppData\Local\Lavasoft
2016-09-27 18:52 - 2016-09-27 18:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2016-09-27 18:52 - 2016-09-27 18:52 - 00000000 ____D C:\Program Files (x86)\Lavasoft
2016-09-27 18:51 - 2016-09-27 18:51 - 00000000 ____D C:\ProgramData\Lavasoft
2016-09-27 11:01 - 2016-09-27 11:01 - 00010149 _____ C:\Users\ntb\Desktop\Krakow3.odt
2016-09-27 10:58 - 2016-09-27 11:45 - 00017774 _____ C:\Users\ntb\Desktop\Krakow 2.odt
2016-09-27 10:35 - 2016-09-27 10:35 - 00016484 _____ C:\Users\ntb\Desktop\Krakow.odt
2016-09-21 21:00 - 2016-09-21 21:07 - 00000000 ____D C:\Users\ntb\Desktop\Stiahnuta hudba
2016-09-20 06:49 - 2016-09-20 06:49 - 00000792 _____ C:\Users\ntb\Desktop\Dokumenty - odkaz.lnk
2016-09-18 20:42 - 2016-09-18 20:42 - 00115906 _____ C:\Users\ntb\Desktop\AliExpress.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-10-16 19:53 - 2015-12-24 10:41 - 00000000 ____D C:\Users\ntb
2016-10-16 19:43 - 2014-05-07 22:09 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-10-16 17:57 - 2015-12-24 10:40 - 01008216 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-10-16 17:57 - 2015-10-30 09:21 - 00000000 ____D C:\WINDOWS\INF
2016-10-16 15:49 - 2015-10-30 09:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-10-16 15:49 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-10-16 15:47 - 2015-10-30 09:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-10-16 15:43 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2016-10-16 15:43 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\Macromed
2016-10-16 15:43 - 2014-05-07 22:09 - 00003820 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-10-16 15:22 - 2014-05-07 20:20 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-10-14 17:51 - 2015-01-08 11:10 - 00000000 ____D C:\Users\ntb\Downloads\Bedne
2016-10-14 17:23 - 2014-05-07 20:52 - 00004188 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{80759E2A-3444-42C4-9A53-A99786A935CB}
2016-10-14 17:13 - 2015-12-24 14:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-10-14 17:13 - 2014-05-14 18:32 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-10-14 17:13 - 2014-05-14 18:32 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-10-14 17:12 - 2014-05-07 21:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-10-13 23:39 - 2015-10-30 08:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-10-13 18:29 - 2014-05-07 20:20 - 143495576 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-10-13 18:20 - 2014-05-14 18:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-10-13 18:12 - 2015-11-08 16:32 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-10-13 18:12 - 2014-12-28 13:40 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-10-10 20:19 - 2015-11-18 12:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-10-10 20:19 - 2014-05-07 21:21 - 00001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-10-10 18:20 - 2015-08-18 21:15 - 00003964 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1401652102
2016-10-10 18:20 - 2014-06-01 21:48 - 00001120 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2016-10-10 18:20 - 2014-06-01 21:48 - 00000000 ____D C:\Program Files (x86)\Opera
2016-10-10 18:09 - 2016-05-14 12:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-10-10 18:06 - 2015-02-26 14:17 - 00153392 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2016-10-10 18:06 - 2015-02-26 14:17 - 00149832 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2016-10-05 17:52 - 2015-12-24 10:41 - 00000000 ____D C:\Users\DefaultAppPool
2016-10-05 17:39 - 2016-07-17 00:47 - 00000000 ___HD C:\$WINDOWS.~BT
2016-10-01 18:03 - 2016-04-07 19:43 - 00000892 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
2016-09-27 18:54 - 2015-07-22 21:53 - 00000000 ____D C:\ProgramData\GRETECH
2016-09-27 18:54 - 2015-07-22 21:52 - 00001270 _____ C:\Users\ntb\AppData\Roaming\Microsoft\Windows\Start Menu\GOM Player.lnk
2016-09-27 18:54 - 2015-07-22 21:52 - 00000000 ____D C:\Program Files (x86)\GRETECH
2016-09-26 21:30 - 2014-08-04 18:14 - 00000000 ____D C:\Users\ntb\AppData\Roaming\Skype
2016-09-21 21:28 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\rescache
2016-09-21 21:05 - 2016-08-15 19:39 - 00000000 ____D C:\Users\ntb\Desktop\Nový priečinok (4)
2016-09-21 21:00 - 2015-11-03 21:43 - 00000000 ____D C:\Users\ntb\AppData\Roaming\foobar2000
2016-09-21 16:56 - 2015-08-07 21:26 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-09-20 09:01 - 2015-10-30 09:24 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
2016-09-20 09:01 - 2015-10-30 09:24 - 00000000 ___SD C:\WINDOWS\system32\F12
2016-09-20 09:01 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2016-09-20 09:01 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\setup
2016-09-20 09:01 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\oobe
2016-09-20 09:01 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\migwiz
2016-09-20 09:01 - 2015-10-30 08:31 - 00000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2016-09-20 09:01 - 2015-10-30 08:31 - 00000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2016-09-20 09:01 - 2015-10-30 08:28 - 00000000 ____D C:\WINDOWS\SysWOW64\Dism
2016-09-20 09:01 - 2015-10-30 08:28 - 00000000 ____D C:\WINDOWS\system32\Dism
2016-09-20 09:00 - 2015-10-30 09:24 - 00000000 ___RD C:\WINDOWS\PrintDialog
2016-09-20 09:00 - 2015-10-30 09:24 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2016-09-20 09:00 - 2015-10-30 09:24 - 00000000 ___RD C:\WINDOWS\DevicesFlow
2016-09-20 09:00 - 2015-10-30 09:24 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2016-09-20 09:00 - 2015-10-30 09:24 - 00000000 ____D C:\Program Files\Windows Defender
2016-09-20 09:00 - 2015-10-30 09:24 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2016-09-20 09:00 - 2015-10-30 09:24 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2016-09-18 21:20 - 2014-05-09 23:40 - 00000000 ____D C:\Users\ntb\AppData\Local\ElevatedDiagnostics
2016-09-18 18:48 - 2016-05-19 22:07 - 00000000 ____D C:\Users\ntb\Documents\Ford
2016-09-18 14:27 - 2016-02-13 19:05 - 00000000 ____D C:\ProgramData\Package Cache

==================== Files in the root of some directories =======

2014-12-20 22:32 - 2015-12-10 08:41 - 0000040 _____ () C:\Users\ntb\AppData\Roaming\cdr.ini
2015-01-08 11:49 - 2015-02-17 14:43 - 0000032 _____ () C:\Users\ntb\AppData\Roaming\msboeqi.dat
2015-01-08 11:49 - 2015-01-08 11:49 - 0008604 _____ () C:\Users\ntb\AppData\Roaming\msxmsqvl.dat
2015-01-22 08:44 - 2015-01-22 08:44 - 0074889 _____ () C:\Users\ntb\AppData\Local\084AE95F_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000265 _____ () C:\Users\ntb\AppData\Local\084AE95F_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 0138335 _____ () C:\Users\ntb\AppData\Local\205CED23_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000314 _____ () C:\Users\ntb\AppData\Local\205CED23_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 1517409 _____ () C:\Users\ntb\AppData\Local\4461A4D8_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000263 _____ () C:\Users\ntb\AppData\Local\4461A4D8_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 0103560 _____ () C:\Users\ntb\AppData\Local\516B3EA5_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000290 _____ () C:\Users\ntb\AppData\Local\516B3EA5_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 1331684 _____ () C:\Users\ntb\AppData\Local\53E9472D_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:02 - 0000126 _____ () C:\Users\ntb\AppData\Local\53E9472D_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 09:05 - 6758400 _____ () C:\Users\ntb\AppData\Local\5D067DA4_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000316 _____ () C:\Users\ntb\AppData\Local\5D067DA4_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 0092702 _____ () C:\Users\ntb\AppData\Local\73A5D503_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000289 _____ () C:\Users\ntb\AppData\Local\73A5D503_stp.CIS.part
2014-04-01 14:58 - 2014-04-01 14:58 - 0000000 _____ () C:\Users\ntb\AppData\Local\AtStart.txt
2014-06-02 19:30 - 2015-07-20 19:08 - 0030208 _____ () C:\Users\ntb\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-01 14:58 - 2014-04-01 14:58 - 0000000 _____ () C:\Users\ntb\AppData\Local\DSwitch.txt
2014-04-01 14:58 - 2014-04-01 14:58 - 0000000 _____ () C:\Users\ntb\AppData\Local\QSwitch.txt
2014-10-06 21:35 - 2014-12-30 08:16 - 0007618 _____ () C:\Users\ntb\AppData\Local\Resmon.ResmonCfg
2015-04-28 22:11 - 2015-07-12 17:09 - 0000041 ___SH () C:\ProgramData\.zreglib
2014-06-10 22:24 - 2014-06-10 22:24 - 0682537 _____ () C:\ProgramData\1402430800.bdinstall.bin
2014-06-10 22:26 - 2014-06-10 22:26 - 0063086 _____ () C:\ProgramData\1402431971.bdinstall.bin
2014-06-10 22:56 - 2014-06-10 22:56 - 0215453 _____ () C:\ProgramData\1402433674.bdinstall.bin
2014-07-07 21:49 - 2014-07-07 21:49 - 0037825 _____ () C:\ProgramData\1404762577.bdinstall.bin
2014-07-07 21:50 - 2014-07-07 21:50 - 0098096 _____ () C:\ProgramData\1404762580.bdinstall.bin

Some files in TEMP:
====================
C:\Users\ntb\AppData\Local\Temp\atl110.dll
C:\Users\ntb\AppData\Local\Temp\avgnt.exe
C:\Users\ntb\AppData\Local\Temp\CustomizeControls.dll


Some zero byte size files/folders:
==========================
C:\Windows\System32\BDSandBoxUH.dll
C:\Windows\System32\BDSandBoxUISkin.dll
C:\Windows\System32\BDSandBoxUISkin32.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================


==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_209_pepper.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\ntb\Desktop" je 2527 MB.


***** Startup Programs *****

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring
"C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray
"C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe" /s [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload
C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent
C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray
"C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PTHOSTTR
C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wondershare Helper Compact.exe
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^CodecPackUpdateChecker.lnk
C:\Windows\SysWOW64\C2MP\UpdateChecker.exe


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
DoNotAllowExceptions REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x0
DoNotAllowExceptions REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]


==================== End Of Log ==============================

Re: Prosim o preventinvku. Dik.

Napsal: 17 říj 2016 20:32
od Rudy
Zdravím!
Spusťte tuto utilitu:
Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

Re: Prosim o preventinvku. Dik.

Napsal: 19 říj 2016 20:13
od peter19500
# AdwCleaner v6.030 - *Logfile created 19/10/2016 *at 20:39:01
# *Updated on 19/10/2016 by Malwarebytes
# *Database : 2016-10-18.1 [*Server]
# *Operating System : Windows 10 Home (X64)
# *Username : ntb - NTB-PC
# *Running from : C:\Users\ntb\Desktop\adwcleaner_6.030.exe
# *Mode: Clean
# *Support : hxxps://www.malwarebytes.com/support



***** [ *Services ] *****



***** [ *Folders ] *****

[-] *Folder deleted: C:\Users\ntb\AppData\Local\avg web tuneup
[-] *Folder deleted: C:\Program Files (x86)\avg web tuneup
[-] *Folder deleted: C:\Program Files (x86)\lavasoft\web companion


***** [ *Files ] *****

[#] *File deleted: C:\WINDOWS\SysNative\LavasoftTcpService64.dll
[#] *File deleted: C:\WINDOWS\SysWOW64\lavasofttcpservice.dll


***** [ DLL ] *****



***** [ WMI ] *****



***** [ *Shortcuts ] *****



***** [ *Scheduled Tasks ] *****



***** [ *Registry ] *****



***** [ *Browsers ] *****



*************************

:: *"Tracing" keys deleted
:: *Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1080 *Bytes] - [19/10/2016 20:39:01]
C:\AdwCleaner\AdwCleaner[R0].txt - [10446 *Bytes] - [03/09/2014 20:01:17]
C:\AdwCleaner\AdwCleaner[R1].txt - [3856 *Bytes] - [30/07/2015 07:31:17]
C:\AdwCleaner\AdwCleaner[S0].txt - [8511 *Bytes] - [03/09/2014 20:10:37]
C:\AdwCleaner\AdwCleaner[S1].txt - [3492 *Bytes] - [30/07/2015 07:37:34]
C:\AdwCleaner\AdwCleaner[S2].txt - [10657 *Bytes] - [19/10/2016 19:13:38]
C:\AdwCleaner\AdwCleaner[S3].txt - [1770 *Bytes] - [19/10/2016 20:24:15]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [1600 *Bytes] ##########

Re: Prosim o preventinvku. Dik.

Napsal: 19 říj 2016 21:04
od Rudy
Dejte nový log FRST.

Re: Prosim o preventinvku. Dik.

Napsal: 22 říj 2016 08:49
od peter19500
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-10-2016
Ran by ntb (22-10-2016 09:44:55)
Running from C:\Users\ntb\Desktop
Windows 10 Home Version 1511 (X64) (2015-12-24 13:24:59)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1661654331-934488394-3447527496-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1661654331-934488394-3447527496-503 - Limited - Disabled)
Guest (S-1-5-21-1661654331-934488394-3447527496-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1661654331-934488394-3447527496-1002 - Limited - Enabled)
ntb (S-1-5-21-1661654331-934488394-3447527496-1000 - Administrator - Enabled) => C:\Users\ntb

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ActivClient x64 (Version: 6.2 - ActivIdentity) Hidden
Adobe Acrobat Reader DC - Slovak (HKLM-x32\...\{AC76BA86-7AD7-1051-7B44-AC0F074E4100}) (Version: 15.020.20039 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.185 - Adobe Systems Incorporated)
Adobe Flash Player 23 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 23.0.0.185 - Adobe Systems Incorporated)
Anti-Twin (Installation 3. 2. 2016) (HKLM-x32\...\Anti-Twin 2016-02-03 00.17.38) (Version: - Joerg Rosenthal, Germany)
ASIO Proxy for foobar2000 (HKLM-x32\...\ASIOProxy) (Version: 0.7.2 - Maxim V.Anisiutkin)
ATI Catalyst Install Manager (HKLM\...\{1ABD3650-2D22-6C01-3CD6-9744E8819CD0}) (Version: 3.0.732.0 - ATI Technologies, Inc.)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.22.54 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{6052a753-acc6-4c02-b5a8-70962ff8e0a4}) (Version: 1.2.69.16114 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{82dc2ab6-088f-4e0a-8e27-bb829481d3bc}) (Version: 1.2.70.16079 - Avira Operations GmbH & Co. KG)
Avira Launcher (x32 Version: 1.2.70.16079 - Avira Operations GmbH & Co. KG) Hidden
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.6.0 - Canon Inc.)
CanoScan LiDE 210 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4809) (Version: - Canon Inc.)
ccc-core-static (x32 Version: 2009.0804.1118.18368 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.20 - Piriform)
CloneCD (HKLM-x32\...\CloneCD) (Version: - SlySoft)
CoreAAC (HKLM-x32\...\CoreAAC) (Version: - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Emergency Download Driver (HKLM-x32\...\{3F0F5AB4-C9CE-4226-8393-E9CFF8369D9D}) (Version: 1.1.16.1526 - Microsoft)
Exact Audio Copy 1.0beta4 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta4 - Andre Wiethoff)
foobar2000 v1.3.9 (HKLM-x32\...\foobar2000) (Version: 1.3.9 - Peter Pawlowski)
Fotogaléria (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Foxit PDF Editor (HKLM-x32\...\Foxit PDF Editor) (Version: 2.2.0.0205 - Foxit Software)
Free Download Manager 3.9.7 (HKLM-x32\...\Free Download Manager_is1) (Version: - FreeDownloadManager.ORG)
GOM Audio (HKLM-x32\...\GomAudio) (Version: 2.2.2.0 - Gretech Corporation)
GOM Player (HKLM-x32\...\GOM Player) (Version: 2.3.7.5261 - Gretech Corporation)
GOM Video Converter (HKLM-x32\...\GOM Video Converter) (Version: 1.1.1.69 - Gretech Corporation)
HiSuite (HKLM-x32\...\Hi Suite) (Version: 1.0 - Huawei Technologies Co.,Ltd)
HP 3D DriveGuard (HKLM\...\{D5F25F29-5A2A-4222-A7B2-C70D72ED600F}) (Version: 4.0.5.1 - Hewlett-Packard Company)
HP Quick Launch Buttons (HKLM-x32\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.50.17.1 - Hewlett-Packard Company)
Intel(R) Management Engine Interface (HKLM\...\HECI) (Version: - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
Intel® Active Management Technology (HKLM\...\MESOL) (Version: - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Java 8 Update 101 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
Java 8 Update 101 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
Lame ACM MP3 Codec (HKLM-x32\...\LameACM) (Version: - )
Local Website Archive 2015 (15.1) (HKLM-x32\...\aigneslocalwebsitearchive_is1) (Version: 2015 (15.1) - http://www.aignes.com)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-041B-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 49.0.1 (x86 sk) (HKLM-x32\...\Mozilla Firefox 49.0.1 (x86 sk)) (Version: 49.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 49.0.1 - Mozilla)
Mozilla Thunderbird 45.3.0 (x86 sk) (HKLM-x32\...\Mozilla Thunderbird 45.3.0 (x86 sk)) (Version: 45.3.0 - Mozilla)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
Nero 7 Ultra Edition (HKLM-x32\...\{CF097717-F174-4144-954A-FBC4BF301051}) (Version: 7.02.9753 - Nero AG)
Nokia Connectivity Cable Driver (HKLM\...\{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}) (Version: 7.1.32.71 - )
Nokia Connectivity Cable Driver (HKLM-x32\...\{29373274-977E-413C-A4DE-DC0F8E80C429}) (Version: 7.1.172.0 - Nokia)
Nokia PC Suite (HKLM-x32\...\Nokia PC Suite) (Version: 7.1.180.94 - Nokia)
Nokia PC Suite (x32 Version: 7.1.180.94 - Nokia) Hidden
OpenOffice 4.1.2 (HKLM-x32\...\{EF194FA4-99F4-4C36-AC30-B2C2DE1C170D}) (Version: 4.12.9782 - Apache Software Foundation)
Opera Stable 40.0.2308.90 (HKLM-x32\...\Opera 40.0.2308.90) (Version: 40.0.2308.90 - Opera Software)
PC Connectivity Solution (HKLM-x32\...\{6D01D1B1-17BD-4F10-BB11-F08F0C47D42B}) (Version: 12.0.109.0 - Nokia)
QLBCASL (x32 Version: 6.40.17.2 - Hewlett-Packard) Hidden
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.16011.2 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.3.16011.2 - Samsung Electronics Co., Ltd.) Hidden
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.55.0 - Samsung Electronics Co., Ltd.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 8.3.0.9150 - Microsoft Corporation)
Skype™ 7.24 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.24.104 - Skype Technologies S.A.)
SoundMAX (HKLM-x32\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: 6.10.2.7255 - Analog Devices)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated)
TomTom HOME (HKLM-x32\...\{5DCB2EB3-87AD-426E-8D74-8B92C9D731C4}) (Version: 2.9.8 - Meno vašej spoločnosti)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Web Companion (HKLM-x32\...\{7135b48a-8f51-4ecb-9e94-3f53a0a85937}) (Version: 2.3.1471.2857 - Lavasoft)
Windows 7 Codec Pack 4.0.9 (HKLM-x32\...\Windows 7 - Codec Pack) (Version: 4.0.9 - Windows 7 Codec Pack)
Windows Device Recovery Tool 3.1.5 (HKLM-x32\...\{c47fc5ee-8e06-46e8-95e4-389d2d1c9cb3}) (Version: 3.1.5 - Microsoft)
Windows Driver Package - FTDI CDM Driver Package - Bus/D2XX Driver (07/10/2015 2.12.06) (HKLM\...\B85E5F21D69245012A4E4C2DFAF38615FC7CF7AA) (Version: 07/10/2015 2.12.06 - FTDI)
Windows Driver Package - FTDI CDM Driver Package - VCP Driver (07/10/2015 2.12.06) (HKLM\...\71B7FC12B248030B4BBBCA0C57826D74F64DB010) (Version: 07/10/2015 2.12.06 - FTDI)
Windows Driver Package - Nokia Modem (02/25/2011 4.7) (HKLM\...\E0AC723A3DE3A04256288CADBBB011B112AED454) (Version: 02/25/2011 4.7 - Nokia)
Windows Driver Package - Nokia Modem (02/25/2011 7.01.0.9) (HKLM\...\72A50F48CC5601190B9C4E74D81161693133E7F7) (Version: 02/25/2011 7.01.0.9 - Nokia)
Windows Driver Package - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
WinUsb CoInstallers (HKLM-x32\...\{9755918A-CDF8-4F1E-8453-6359CF1A330A}) (Version: 1.1.12.1526 - Microsoft)
WinUSB Compatible ID Drivers (HKLM-x32\...\{A4A0B236-6046-4CAB-8177-1EAF61112C75}) (Version: 1.1.11.1526 - Microsoft)
WinUSB Drivers ext (HKLM-x32\...\{29BAAF65-09E5-4F52-8D15-2FAF2E23A8DC}) (Version: 1.1.24.1544 - Microsoft)
WinZip 19.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240E5}) (Version: 19.0.11293 - WinZip Computing, S.L. )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1661654331-934488394-3447527496-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileCoAuth.exe (Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {015048B3-2961-4AB1-9B07-66EB7433E084} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {04529772-5564-4048-94BB-D53429D18FEB} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {04EDA81A-3351-4F62-8DCD-B19714D5DDEB} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {0506AA45-30A0-4E63-AED9-1A6205F7990A} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {11CAAB93-16ED-4098-9AF6-2F0BE7FD8759} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {170A4339-C071-49FB-A132-5D18AB31A1E0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-07-13] (Piriform Ltd)
Task: {17992B7C-F088-4320-A8C9-C86856A083B5} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-10-13] (Microsoft Corporation)
Task: {1C30D6C3-DF19-46CE-9FB2-F6D4CB6C2590} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {20506760-9F6E-451C-AB6B-43DD487BF044} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_209_pepper.exe
Task: {20CFB8AC-AEB2-4056-A7DB-ADF9D1801F34} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {2334394A-EDD3-4F33-B534-DC2A80B4099B} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {265DE3A7-62FE-47C8-9FA8-788B9B824350} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {39EBC89C-272F-4C46-B7BB-979B7050AB12} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {39FF07BC-C352-4E40-ADBC-7B2D8780F731} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {3E8D6675-79AE-4B8F-B678-165416F8E2FF} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {3F283146-28E2-48D1-84F7-F47BA10B00ED} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {427841EB-D7B5-4733-9C7C-C142214577DE} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {487E89A8-460E-4612-B53E-AC6307506EE8} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {49A3357C-7566-4B97-9ACC-C49413D8DE29} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-09-16] (Adobe Systems Incorporated)
Task: {52909873-5C7E-4870-8EBE-291F6DD15AC5} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe
Task: {53947676-BDC9-4C83-908A-01F5502DED2F} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {60311543-8AFB-44BD-8482-4A334843BCF4} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {6CE45724-9390-47FF-AF41-A346B641E90D} - System32\Tasks\Opera scheduled Autoupdate 1401652102 => C:\Program Files (x86)\Opera\launcher.exe [2016-10-17] (Opera Software)
Task: {704E1A4B-9F87-4AD3-83C5-B7EE56F5DCA4} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {7527A6A0-EFD0-4B87-87D9-6A9E15581725} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {75EE3A39-E022-4056-94A2-C4A4B700B5E6} - System32\Tasks\Java Platform SE Auto Updater => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2016-06-22] (Oracle Corporation)
Task: {7ADABDA3-65F2-4E83-9A9E-0D75168BDB38} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
Task: {854E409E-0568-45EB-B2B8-6DD16FC7D7D5} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {8B53D5E4-0C8B-4F73-A742-C06129C1F1EE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-10-16] (Adobe Systems Incorporated)
Task: {8E95EE4D-68D6-4C6E-8859-E04F704EBC64} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {91232EFB-8FF8-48D1-B0A0-5CA2977975A5} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {92BBA035-FA38-46AB-AD57-3CE1F6BF98B1} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {96A6FEE4-601D-4AC0-893A-07BC6DBDC8C4} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {A15566FA-32F1-418D-B4C7-B59234215CC3} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {A852DFAA-EF93-451A-997D-3607CC36F74C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {AA8E3375-BD39-4DF3-88CB-39CCB8502E0C} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {AD2D9300-7A5A-4008-A694-A08E894AA823} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {B78D8388-7D7E-4094-AC67-1750BE348BA7} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {BB9BEB5A-258B-4F86-8108-5A5F1B6F0CF8} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {BBD451B0-10E9-412A-BCB4-4CB9C6422201} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {BD0E78E6-E1A6-47CA-A8E3-D100E900B8BC} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {C0B32324-8935-4027-95E9-955A93AC8AE0} - System32\Tasks\Program k provádění aktualizací online Adobe => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-09-16] (Adobe Systems Incorporated)
Task: {D2278097-1180-497F-98ED-FEF064ADACD2} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_209_pepper.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2016-08-26 11:08 - 2016-08-26 11:08 - 00192200 _____ () C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
2015-10-30 09:18 - 2015-10-30 09:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-09-14 22:51 - 2016-09-07 07:39 - 02656952 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-09-14 22:51 - 2016-09-07 07:39 - 02656952 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2015-04-16 20:55 - 2010-07-29 18:19 - 00293888 _____ () C:\Program Files (x86)\Total Video Converter\TVCShellExtx64.dll
2015-12-26 17:13 - 2015-12-07 06:14 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-07-19 22:32 - 2016-07-01 05:48 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-09-14 22:45 - 2016-09-07 06:15 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-09-14 22:45 - 2016-09-07 06:10 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-09-14 22:45 - 2016-09-07 06:10 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-09-14 22:45 - 2016-09-07 06:13 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-07-13 21:42 - 2016-07-13 21:42 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1051.dll
2016-04-20 16:51 - 2016-04-20 16:52 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2014-04-01 14:36 - 2010-03-03 20:08 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2016-04-20 16:51 - 2016-04-20 16:52 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-04-20 16:51 - 2016-04-20 16:52 - 02941440 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\MessagingNativeCore.dll
2016-04-20 16:51 - 2016-04-20 16:52 - 00583168 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\MessagingEntityExtractionProxy.dll
2016-04-20 16:51 - 2016-04-20 16:52 - 01300992 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\MessagingNativeBase.dll
2016-04-20 16:51 - 2016-04-20 16:52 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:A4F602C6 [278]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\localhost -> localhost

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1661654331-934488394-3447527496-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\ntb\Downloads\Bedne\Nový priečinok\Kríž (2).jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^CodecPackUpdateChecker.lnk => C:\Windows\pss\CodecPackUpdateChecker.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: CloneCDTray => "C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe" /s
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: PC Suite Tray => "C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
MSCONFIG\startupreg: PTHOSTTR => C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
MSCONFIG\startupreg: QlbCtrl.exe => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
MSCONFIG\startupreg: Wondershare Helper Compact.exe => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM\...\StartupApproved\Run: => "SynTPEnh"
HKLM\...\StartupApproved\Run32: => "CanonQuickMenu"
HKLM\...\StartupApproved\Run32: => "ProductUpdater"
HKLM\...\StartupApproved\Run32: => "KiesTrayAgent"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\StartupApproved\Run: => "KiesPreload"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\StartupApproved\Run: => "KiesPDLR.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\StartupApproved\Run: => "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\StartupApproved\Run: => "TomTomHOME.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\StartupApproved\Run: => "Free Download Manager"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\StartupApproved\Run: => "PC Suite Tray"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{53CFB382-9708-4872-BBE4-F24BBF8E1F5F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{25751598-D985-40CD-B321-B527F60A3B6B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [UDP Query User{B8D742FA-1082-4F23-9BD7-20C5A8892885}C:\program files (x86)\signalyst\hqplayer desktop 3\hqplayer-desktop.exe] => (Allow) C:\program files (x86)\signalyst\hqplayer desktop 3\hqplayer-desktop.exe
FirewallRules: [TCP Query User{FE056206-75A7-4FDE-904A-1E6E985B22F9}C:\program files (x86)\signalyst\hqplayer desktop 3\hqplayer-desktop.exe] => (Allow) C:\program files (x86)\signalyst\hqplayer desktop 3\hqplayer-desktop.exe
FirewallRules: [UDP Query User{9766F39B-718B-42D0-85F6-2C5EE16B52D3}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{9AF2D311-9349-4C2E-86CD-186CE34A7464}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{99C3F222-C185-4BE7-AE18-F97F8BE675EC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{44240387-703D-4BAF-96EE-BB4EB6D83708}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{0B4937E1-48F9-4F25-9A64-3170623DE2CA}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{35016D7E-7BE4-4D11-901F-D19EC16E476C}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [TCP Query User{B632AD77-E785-4586-BB59-6A6431D0C2FF}C:\program files (x86)\dvdvideosoft\free torrent download\freetorrentdownload.exe] => (Allow) C:\program files (x86)\dvdvideosoft\free torrent download\freetorrentdownload.exe
FirewallRules: [UDP Query User{4D2F4ED5-4F0E-4227-9D31-F35D484FFFEE}C:\program files (x86)\dvdvideosoft\free torrent download\freetorrentdownload.exe] => (Allow) C:\program files (x86)\dvdvideosoft\free torrent download\freetorrentdownload.exe

==================== Restore Points =========================

13-10-2016 18:14:48 Windows Update
19-10-2016 17:20:11 Windows Update

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/22/2016 09:28:29 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (10/19/2016 09:08:17 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 01B language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (10/19/2016 09:08:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 01B language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (10/19/2016 08:13:22 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program adwcleaner_6.030.exe version 6.0.3.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 1a10

Start Time: 01d22a2b9e5c2de2

Termination Time: 33

Application Path: C:\Users\ntb\Desktop\adwcleaner_6.030.exe

Report Id: 87d175f9-9627-11e6-9bf6-00247eee44a0

Faulting package full name:

Faulting package-relative application ID:

Error: (10/19/2016 08:07:59 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 01B language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (10/19/2016 08:07:59 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 01B language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (10/19/2016 07:16:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (10/19/2016 05:20:40 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Cryptographic Services zlyhala pri spracovávaní volania OnIdentity() v objekte System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Error: (10/16/2016 09:07:27 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (10/16/2016 05:57:37 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 01B language ID. The first DWORD in the Data section contains the Win32 error code.


System errors:
=============
Error: (10/22/2016 07:04:16 AM) (Source: DCOM) (EventID: 10016) (User: ntb-PC)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user ntb-PC\ntb SID (S-1-5-21-1661654331-934488394-3447527496-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.

Error: (10/22/2016 07:04:16 AM) (Source: DCOM) (EventID: 10016) (User: ntb-PC)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user ntb-PC\ntb SID (S-1-5-21-1661654331-934488394-3447527496-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.

Error: (10/22/2016 07:04:16 AM) (Source: DCOM) (EventID: 10016) (User: ntb-PC)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user ntb-PC\ntb SID (S-1-5-21-1661654331-934488394-3447527496-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.

Error: (10/22/2016 07:04:15 AM) (Source: DCOM) (EventID: 10016) (User: ntb-PC)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user ntb-PC\ntb SID (S-1-5-21-1661654331-934488394-3447527496-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.

Error: (10/22/2016 07:04:15 AM) (Source: DCOM) (EventID: 10016) (User: ntb-PC)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user ntb-PC\ntb SID (S-1-5-21-1661654331-934488394-3447527496-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.

Error: (10/22/2016 07:04:15 AM) (Source: DCOM) (EventID: 10016) (User: ntb-PC)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user ntb-PC\ntb SID (S-1-5-21-1661654331-934488394-3447527496-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.

Error: (10/22/2016 07:04:15 AM) (Source: DCOM) (EventID: 10016) (User: ntb-PC)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user ntb-PC\ntb SID (S-1-5-21-1661654331-934488394-3447527496-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.

Error: (10/22/2016 07:04:15 AM) (Source: DCOM) (EventID: 10016) (User: ntb-PC)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user ntb-PC\ntb SID (S-1-5-21-1661654331-934488394-3447527496-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.

Error: (10/22/2016 07:04:12 AM) (Source: DCOM) (EventID: 10016) (User: ntb-PC)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user ntb-PC\ntb SID (S-1-5-21-1661654331-934488394-3447527496-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.

Error: (10/22/2016 07:04:12 AM) (Source: DCOM) (EventID: 10016) (User: ntb-PC)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user ntb-PC\ntb SID (S-1-5-21-1661654331-934488394-3447527496-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.


CodeIntegrity:
===================================
Date: 2016-10-19 21:03:11.877
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-10-19 19:33:37.077
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-10-16 20:29:46.016
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-10-16 20:08:30.925
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-10-16 20:08:30.860
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-10-16 20:01:42.491
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-10-16 20:01:42.466
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-10-16 19:55:27.504
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-10-16 19:55:27.479
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-09-21 16:55:20.750
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Core(TM)2 Duo CPU T9550 @ 2.66GHz
Percentage of memory in use: 47%
Total physical RAM: 3996.26 MB
Available physical RAM: 2092.37 MB
Total Virtual: 8092.26 MB
Available Virtual: 6072.54 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.34 GB) (Free:22.82 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: A6B6BDF8)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=461 MB) - (Type=27)

==================== End of Addition.txt ============================

Re: Prosim o preventinvku. Dik.

Napsal: 22 říj 2016 10:13
od Rudy
Toto je pouze Addition. Potřebuji ještě vidět log FRST.

Re: Prosim o preventinvku. Dik.

Napsal: 23 říj 2016 16:15
od peter19500
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-10-2016
Ran by ntb (administrator) on NTB-PC (23-10-2016 17:08:47)
Running from C:\Users\ntb\Desktop
Loaded Profiles: ntb (Available Profiles: ntb & DefaultAppPool)
Platform: Windows 10 Home Version 1511 (X64) Language: Slovenčina (Slovensko)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(ActivIdentity) C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\AMT\LMS.exe
() C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Intel Corporation) C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Intel Corporation) C:\Program Files (x86)\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\WerFault.exe
Failed to access process -> svchost.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.90\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.90\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.90\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.90\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.90\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.90\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.90\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.90\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\40.0.2308.90\opera.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\update.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\updrgui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe


==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-03] (Synaptics Incorporated)
HKLM\...\Run: [picon] => C:\Program Files (x86)\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe [358936 2009-07-15] (Intel Corporation)
HKLM\...\Run: [SoundMAX] => C:\Program Files (x86)\Analog Devices\SoundMAX\soundmax.exe [3866624 2009-05-18] (Analog Devices, Inc.)
HKLM\...\Run: [acevents] => C:\Program Files\ActivIdentity\ActivClient\acevents.exe [196648 2009-06-03] (ActivIdentity)
HKLM\...\Run: [accrdsub] => C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [483880 2009-06-03] (ActivIdentity)
HKLM-x32\...\Run: [SoundMAXPnP] => C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1314816 2009-05-18] (Analog Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [917584 2016-10-10] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1298504 2014-11-08] (CANON INC.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [318248 2016-01-08] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [60136 2016-08-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [598552 2016-06-22] (Oracle Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [KiesPDLR.exe] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1021736 2016-01-08] (Samsung)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1572648 2016-01-08] (Samsung)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2007-06-27] (Nero AG)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-07-13] (TomTom)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [Free Download Manager] => C:\Program Files (x86)\Free Download Manager\fdm.exe [5717584 2015-10-28] (FreeDownloadManager.ORG)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8891608 2016-07-13] (Piriform Ltd)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {097d7b58-19bb-11e6-9be4-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {2a3524f6-649d-11e6-9bef-18a90581b1a5} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {62218dd4-7ac3-11e6-9bf3-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {6221977a-7ac3-11e6-9bf3-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {622197ea-7ac3-11e6-9bf3-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {6221a3cf-7ac3-11e6-9bf3-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {7433da79-3dfd-11e6-9be8-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {8f78a5e9-e15c-11e5-9bdf-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {8f78ab60-e15c-11e5-9bdf-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {8f78adb9-e15c-11e5-9bdf-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {8f78af05-e15c-11e5-9bdf-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {a221ce63-f6a1-11e5-9be2-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {a6f8379f-7ab5-11e6-9bf1-00247eee44a0} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64\FileSyncShell64.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64\FileSyncShell64.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64\FileSyncShell64.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncShell.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncShell.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncShell.dll [2015-12-24] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{4ebd6ac1-c602-411d-acb8-a0fe61a9414f}: [DhcpNameServer] 192.168.2.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131208505197382864&GUID=3114ABCA-E2DE-4105-A3E8-C1669E4C763F
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131208505197624020&GUID=3114ABCA-E2DE-4105-A3E8-C1669E4C763F
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131208505197629640&GUID=3114ABCA-E2DE-4105-A3E8-C1669E4C763F
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> 12618F81508237FF74E655DBBAE976EF URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> {2DC90D8C-5E7D-491E-8E9D-FCF17A803778} URL = hxxp://yandex.com/yandsearch?win=160&clid=1989596&text={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_101\bin\ssv.dll [2016-08-06] (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-06] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-08-06] (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll [2015-10-28] (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-06] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} - No File
DPF: HKLM-x32 {62789780-B744-11D0-986B-00609731A21D} hxxp://195.28.70.134/kapor2/lib/mgaxctrl.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\ntb\AppData\Roaming\TomTom\HOME\Profiles\4xvsx4bf.default [2015-12-02]
FF Extension: (Map status indicator) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [2015-12-01] [not signed]
FF ProfilePath: C:\Users\ntb\AppData\Roaming\Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457 [2016-10-22]
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457 -> Yahoo®
FF Homepage: Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457 -> hxxps://www.google.sk/
FF Extension: (Flash and Video Download) - C:\Users\ntb\AppData\Roaming\Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2016-10-10]
FF Extension: (Skype) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-05-25]
FF HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Firefox\Extensions: [fdm_ffext@freedownloadmanager.org] - C:\ProgramData\Free Download Manager\Firefox\Extensions\2.1.1
FF Extension: (Free Download Manager extension) - C:\ProgramData\Free Download Manager\Firefox\Extensions\2.1.1 [2016-01-31]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_23_0_0_185.dll [2016-10-12] ()
FF Plugin: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-06] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-06] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_185.dll [2016-10-12] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-06] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-06] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pchfckkccldkbclgdepkaonamkignanh] - hxxp://clients2.google.com/service/update2/crx

Opera:
=======
OPR Session Restore: -> is enabled.
OPR Extension: (MediaPlus) - C:\Users\ntb\AppData\Roaming\Opera Software\Opera Stable\Extensions\fpnoagnjlblajeghmbaejnfhekofbecd [2015-12-11]
OPR Extension: (Youtube to mp3 converter) - C:\Users\ntb\AppData\Roaming\Opera Software\Opera Stable\Extensions\geioidjhliialbjcekeejcodiahfplgb [2014-06-01]
OPR Extension: (YouTube Downloader) - C:\Users\ntb\AppData\Roaming\Opera Software\Opera Stable\Extensions\kclijeogghhkmenkommbnjobhnndpfba [2015-11-16]
OPR Extension: (FVD Video Downloader) - C:\Users\ntb\AppData\Roaming\Opera Software\Opera Stable\Extensions\neacgcjokggofibnbfapeaejhclmpple [2016-09-25]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ac.sharedstore; C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe [277032 2009-06-03] (ActivIdentity)
R2 AEADIFilters; C:\WINDOWS\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [1086040 2016-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [475232 2016-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [475232 2016-10-10] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1489240 2016-10-10] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [324304 2016-08-19] (Avira Operations GmbH & Co. KG)
R2 BcmBtRSupport; C:\WINDOWS\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1364096 2016-05-25] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1687680 2016-05-25] (Microsoft Corporation)
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [192200 2016-08-26] ()
R2 LMS; C:\Program Files (x86)\Intel\AMT\LMS.exe [174616 2009-07-15] (Intel Corporation)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [279848 2007-06-27] (Nero AG)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.)
R2 UNS; C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2058776 2009-07-15] (Intel Corporation)
S3 vmicvss; C:\WINDOWS\System32\ICSvc.dll [511488 2016-09-07] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364456 2016-09-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-09-07] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [149832 2016-10-10] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-29] (AVG Technologies)
R1 avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [153392 2016-10-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [35488 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\WINDOWS\system32\DRIVERS\avnetflt.sys [78208 2016-05-14] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\WINDOWS\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R3 BTHprint; C:\WINDOWS\system32\DRIVERS\bthprint.sys [65536 2015-10-30] (Microsoft Corporation)
S3 dtlitescsibus; C:\WINDOWS\System32\DRIVERS\dtlitescsibus.sys [30264 2015-07-12] (Disc Soft Ltd)
R3 ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R3 ElbyCDFL; C:\Windows\SysWOW64\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R3 HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [19000 2010-02-25] (Hewlett-Packard Company)
S3 HWHandSet; C:\WINDOWS\system32\DRIVERS\hw_quusbmdm.sys [223232 2016-05-25] (Huawei Technologies Co., Ltd.)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2016-05-25] (Huawei Technologies Co., Ltd.)
R3 rismcx64; C:\WINDOWS\system32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.)
S3 ssceserd; C:\WINDOWS\system32\DRIVERS\ssceserd.sys [158024 2015-05-21] (MCCI Corporation)
S3 VBoxUSB; C:\WINDOWS\System32\Drivers\VBoxUSB.sys [113952 2014-02-25] (Oracle Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
U3 idsvc; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-10-22 20:16 - 2016-10-22 20:22 - 00000000 ____D C:\Users\ntb\Desktop\pneu
2016-10-22 20:16 - 2016-10-22 20:16 - 00000000 ____D C:\Users\ntb\Desktop\Nový priečinok (5)
2016-10-22 09:39 - 2016-10-23 17:08 - 00023489 _____ C:\Users\ntb\Desktop\FRST.txt
2016-10-22 09:38 - 2016-10-22 09:38 - 00000000 ____D C:\Users\ntb\Desktop\FRST-OlderVersion
2016-10-19 19:09 - 2016-10-19 19:09 - 03910208 _____ C:\Users\ntb\Desktop\adwcleaner_6.030.exe
2016-10-16 20:47 - 2016-10-16 20:47 - 00006861 _____ C:\Users\ntb\Desktop\Addition.rar
2016-10-16 20:05 - 2016-10-22 09:46 - 00042793 _____ C:\Users\ntb\Desktop\Addition.txt
2016-10-16 20:01 - 2016-10-23 17:08 - 00000000 ____D C:\FRST
2016-10-16 19:30 - 2016-10-22 09:38 - 02407424 _____ (Farbar) C:\Users\ntb\Desktop\FRST64.exe
2016-10-16 15:51 - 2016-10-16 15:52 - 01412765 _____ (neftojpg.com ) C:\Users\ntb\Downloads\neftojpg_setup.exe
2016-10-12 18:23 - 2016-10-05 09:56 - 01644736 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-10-12 18:23 - 2016-10-05 09:56 - 01242304 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2016-10-12 18:23 - 2016-10-05 09:56 - 00602304 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2016-10-12 18:23 - 2016-10-05 09:56 - 00591040 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2016-10-12 18:23 - 2016-10-05 09:56 - 00144576 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-10-12 18:23 - 2016-10-05 09:56 - 00085696 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-10-12 18:23 - 2016-10-05 09:01 - 01637216 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2016-10-12 18:23 - 2016-10-05 06:10 - 00784384 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-10-12 18:23 - 2016-10-05 06:10 - 00602624 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-10-12 18:23 - 2016-10-05 05:48 - 02437120 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2016-10-12 18:23 - 2016-10-05 05:10 - 00687616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-10-12 18:23 - 2016-10-05 05:09 - 00501760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-10-12 18:23 - 2016-10-05 04:55 - 04895232 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-10-12 18:23 - 2016-10-05 04:50 - 22379520 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-10-12 18:23 - 2016-10-05 04:50 - 11545088 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-10-12 18:23 - 2016-10-05 04:39 - 24611328 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-10-12 18:23 - 2016-10-05 04:33 - 14255104 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2016-10-12 18:23 - 2016-10-05 04:27 - 09920512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-10-12 18:23 - 2016-10-05 04:26 - 07836672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-10-12 18:23 - 2016-10-05 04:13 - 19349504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-10-12 18:23 - 2016-10-05 04:13 - 18675200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-10-12 18:23 - 2016-10-05 04:06 - 12587008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2016-10-12 18:23 - 2016-10-05 04:01 - 05660160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-10-12 18:23 - 2016-09-17 09:45 - 02610176 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2016-10-12 18:23 - 2016-09-17 08:45 - 06312448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2016-10-12 18:23 - 2016-09-17 08:22 - 04405248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2016-10-12 18:22 - 2016-10-05 09:56 - 00329920 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2016-10-12 18:22 - 2016-10-05 09:56 - 00290496 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2016-10-12 18:22 - 2016-10-05 09:20 - 01030408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-10-12 18:22 - 2016-10-05 09:20 - 00875480 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-10-12 18:22 - 2016-10-05 09:19 - 00129376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tm.sys
2016-10-12 18:22 - 2016-10-05 09:18 - 07468384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-10-12 18:22 - 2016-10-05 09:18 - 01317640 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-10-12 18:22 - 2016-10-05 09:18 - 01142560 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-10-12 18:22 - 2016-10-05 09:01 - 01337184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2016-10-12 18:22 - 2016-10-05 08:54 - 01297760 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2016-10-12 18:22 - 2016-10-05 08:17 - 03693064 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-10-12 18:22 - 2016-10-05 08:15 - 00304752 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe
2016-10-12 18:22 - 2016-10-05 08:14 - 22561256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-10-12 18:22 - 2016-10-05 08:09 - 00604920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-10-12 18:22 - 2016-10-05 07:45 - 00987488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2016-10-12 18:22 - 2016-10-05 07:39 - 01988448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-10-12 18:22 - 2016-10-05 07:39 - 00576856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2016-10-12 18:22 - 2016-10-05 07:38 - 00636296 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2016-10-12 18:22 - 2016-10-05 07:38 - 00393056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2016-10-12 18:22 - 2016-10-05 07:37 - 00640976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2016-10-12 18:22 - 2016-10-05 07:31 - 00422240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2016-10-12 18:22 - 2016-10-05 07:25 - 00871776 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvstore.dll
2016-10-12 18:22 - 2016-10-05 07:23 - 00305808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpeffects.dll
2016-10-12 18:22 - 2016-10-05 07:08 - 02937896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-10-12 18:22 - 2016-10-05 07:05 - 00256704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe
2016-10-12 18:22 - 2016-10-05 07:01 - 00046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2016-10-12 18:22 - 2016-10-05 07:00 - 00190464 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2016-10-12 18:22 - 2016-10-05 06:51 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe
2016-10-12 18:22 - 2016-10-05 06:50 - 00103936 _____ (Microsoft Corporation) C:\WINDOWS\system32\davclnt.dll
2016-10-12 18:22 - 2016-10-05 06:49 - 00127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnpclean.dll
2016-10-12 18:22 - 2016-10-05 06:49 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2016-10-12 18:22 - 2016-10-05 06:47 - 00103936 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevDispItemProvider.dll
2016-10-12 18:22 - 2016-10-05 06:47 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll
2016-10-12 18:22 - 2016-10-05 06:38 - 00236032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpdxm.dll
2016-10-12 18:22 - 2016-10-05 06:35 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpshell.dll
2016-10-12 18:22 - 2016-10-05 06:34 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2016-10-12 18:22 - 2016-10-05 06:33 - 00546456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2016-10-12 18:22 - 2016-10-05 06:32 - 00538744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2016-10-12 18:22 - 2016-10-05 06:30 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2016-10-12 18:22 - 2016-10-05 06:30 - 00287232 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll
2016-10-12 18:22 - 2016-10-05 06:30 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\adsmsext.dll
2016-10-12 18:22 - 2016-10-05 06:29 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2016-10-12 18:22 - 2016-10-05 06:27 - 00370688 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack_win.dll
2016-10-12 18:22 - 2016-10-05 06:23 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsqmcons.exe
2016-10-12 18:22 - 2016-10-05 06:19 - 00717152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\drvstore.dll
2016-10-12 18:22 - 2016-10-05 06:18 - 00253080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpeffects.dll
2016-10-12 18:22 - 2016-10-05 06:17 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\das.dll
2016-10-12 18:22 - 2016-10-05 06:17 - 00166912 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboveLockAppHost.dll
2016-10-12 18:22 - 2016-10-05 06:15 - 00458240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Enumeration.dll
2016-10-12 18:22 - 2016-10-05 06:07 - 01159168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplicationFrame.dll
2016-10-12 18:22 - 2016-10-05 06:05 - 00841728 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2016-10-12 18:22 - 2016-10-05 06:04 - 01718272 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2016-10-12 18:22 - 2016-10-05 06:02 - 01040896 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-10-12 18:22 - 2016-10-05 06:00 - 01661952 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2016-10-12 18:22 - 2016-10-05 06:00 - 00148992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2016-10-12 18:22 - 2016-10-05 06:00 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2016-10-12 18:22 - 2016-10-05 05:57 - 00268288 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2016-10-12 18:22 - 2016-10-05 05:55 - 03549696 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll
2016-10-12 18:22 - 2016-10-05 05:40 - 03589120 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-10-12 18:22 - 2016-10-05 05:40 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\davclnt.dll
2016-10-12 18:22 - 2016-10-05 05:37 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevDispItemProvider.dll
2016-10-12 18:22 - 2016-10-05 05:37 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll
2016-10-12 18:22 - 2016-10-05 05:30 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpdxm.dll
2016-10-12 18:22 - 2016-10-05 05:29 - 01946112 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2016-10-12 18:22 - 2016-10-05 05:29 - 01728000 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-10-12 18:22 - 2016-10-05 05:28 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpshell.dll
2016-10-12 18:22 - 2016-10-05 05:24 - 00217600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll
2016-10-12 18:22 - 2016-10-05 05:24 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adsmsext.dll
2016-10-12 18:22 - 2016-10-05 05:23 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2016-10-12 18:22 - 2016-10-05 05:15 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AboveLockAppHost.dll
2016-10-12 18:22 - 2016-10-05 05:14 - 03585536 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
2016-10-12 18:22 - 2016-10-05 05:13 - 00368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.dll
2016-10-12 18:22 - 2016-10-05 05:05 - 01467904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2016-10-12 18:22 - 2016-10-05 05:04 - 01390080 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-10-12 18:22 - 2016-10-05 05:04 - 00885248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-10-12 18:22 - 2016-10-05 04:59 - 02362880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll
2016-10-12 18:22 - 2016-10-05 04:54 - 01987584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2016-10-12 18:22 - 2016-10-05 04:40 - 01626112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2016-10-12 18:22 - 2016-10-05 04:39 - 13392384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-10-12 18:22 - 2016-10-05 04:39 - 01500672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-10-12 18:22 - 2016-10-05 04:22 - 03664384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-10-12 18:22 - 2016-10-05 04:13 - 12134400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-10-12 18:22 - 2016-09-27 04:39 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2016-10-12 18:22 - 2016-09-17 10:08 - 01752576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-10-12 18:22 - 2016-09-17 09:28 - 03077120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-10-12 18:22 - 2016-09-17 09:12 - 01526272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-10-12 18:22 - 2016-09-17 08:43 - 02552832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-10-12 18:22 - 2016-06-18 06:55 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll
2016-10-12 18:22 - 2016-06-18 06:51 - 00470528 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2016-10-12 18:22 - 2016-06-18 06:49 - 00175104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll
2016-10-12 18:22 - 2016-06-18 06:45 - 00361472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2016-10-12 18:21 - 2016-10-01 04:16 - 00446124 _____ C:\WINDOWS\system32\ApnDatabase.xml
2016-10-12 16:43 - 2016-10-16 15:43 - 20478656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2016-10-10 18:53 - 2016-10-10 18:53 - 00016629 _____ C:\Users\ntb\Desktop\Faktúra DH 20160009.odt
2016-10-10 18:08 - 2016-10-10 18:06 - 00023640 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avusbflt.sys
2016-10-05 17:53 - 2016-10-05 17:54 - 04518690 _____ C:\Users\ntb\Downloads\DD06.tmp
2016-10-05 17:52 - 2016-10-05 17:52 - 00000020 ___SH C:\Users\DefaultAppPool\ntuser.ini
2016-10-01 07:12 - 2016-10-05 17:58 - 00000000 ____D C:\WINDOWS\Panther
2016-09-27 18:54 - 2016-09-27 18:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOM
2016-09-27 18:52 - 2016-10-19 20:39 - 00000000 ____D C:\Program Files (x86)\Lavasoft
2016-09-27 18:52 - 2016-10-19 19:18 - 00000000 ____D C:\Users\ntb\AppData\Roaming\Lavasoft
2016-09-27 18:52 - 2016-09-27 18:52 - 00425744 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll
2016-09-27 18:52 - 2016-09-27 18:52 - 00000000 ____D C:\Users\ntb\AppData\Local\Lavasoft
2016-09-27 18:52 - 2016-09-27 18:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2016-09-27 18:51 - 2016-10-19 19:18 - 00000000 ____D C:\ProgramData\Lavasoft
2016-09-27 11:01 - 2016-09-27 11:01 - 00010149 _____ C:\Users\ntb\Desktop\Krakow3.odt
2016-09-27 10:58 - 2016-09-27 11:45 - 00017774 _____ C:\Users\ntb\Desktop\Krakow 2.odt
2016-09-27 10:35 - 2016-09-27 10:35 - 00016484 _____ C:\Users\ntb\Desktop\Krakow.odt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-10-23 17:06 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-10-23 17:05 - 2014-05-07 20:52 - 00004188 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{80759E2A-3444-42C4-9A53-A99786A935CB}
2016-10-22 21:50 - 2015-12-24 14:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-10-22 21:49 - 2015-10-30 08:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-10-22 21:43 - 2014-05-07 22:09 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-10-22 21:03 - 2016-04-07 19:43 - 00000892 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
2016-10-22 20:58 - 2015-12-24 17:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2016-10-22 20:54 - 2015-01-08 11:10 - 00000000 ____D C:\Users\ntb\Downloads\Bedne
2016-10-22 07:17 - 2015-10-30 09:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-10-22 07:13 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-10-22 07:13 - 2015-10-30 09:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-10-22 07:04 - 2015-08-18 21:15 - 00003964 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1401652102
2016-10-22 07:04 - 2014-06-01 21:48 - 00000000 ____D C:\Program Files (x86)\Opera
2016-10-22 07:03 - 2014-06-01 21:48 - 00001120 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2016-10-19 21:30 - 2015-08-07 21:25 - 00000000 ____D C:\Users\ntb\AppData\Local\Packages
2016-10-19 21:29 - 2015-10-30 09:21 - 00000000 ____D C:\WINDOWS\INF
2016-10-19 21:08 - 2015-12-24 10:40 - 01008216 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-10-19 21:03 - 2015-08-07 21:26 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-10-19 21:00 - 2015-12-24 10:30 - 00224560 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-10-19 20:55 - 2015-10-30 09:24 - 00000000 ___SD C:\WINDOWS\system32\DiagSvcs
2016-10-19 20:55 - 2015-10-30 09:24 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2016-10-19 20:39 - 2014-09-03 20:01 - 00000000 ____D C:\AdwCleaner
2016-10-19 20:09 - 2014-05-11 15:25 - 00000000 ____D C:\Users\ntb\Documents\Hifi
2016-10-19 20:05 - 2014-11-30 15:42 - 00000000 ____D C:\Users\ntb\Documents\Amaterske radio
2016-10-16 19:53 - 2015-12-24 10:41 - 00000000 ____D C:\Users\ntb
2016-10-16 15:43 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2016-10-16 15:43 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\Macromed
2016-10-16 15:43 - 2014-05-07 22:09 - 00003820 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-10-16 15:22 - 2014-05-07 20:20 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-10-14 17:13 - 2014-05-14 18:32 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-10-14 17:13 - 2014-05-14 18:32 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-10-14 17:12 - 2014-05-07 21:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-10-13 18:29 - 2014-05-07 20:20 - 143495576 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-10-13 18:20 - 2014-05-14 18:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-10-13 18:12 - 2015-11-08 16:32 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-10-13 18:12 - 2014-12-28 13:40 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-10-10 20:19 - 2015-11-18 12:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-10-10 20:19 - 2014-05-07 21:21 - 00001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-10-10 18:09 - 2016-05-14 12:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-10-10 18:06 - 2015-02-26 14:17 - 00153392 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2016-10-10 18:06 - 2015-02-26 14:17 - 00149832 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2016-10-05 17:52 - 2015-12-24 10:41 - 00000000 ____D C:\Users\DefaultAppPool
2016-10-05 17:39 - 2016-07-17 00:47 - 00000000 ___HD C:\$WINDOWS.~BT
2016-10-01 02:23 - 2015-10-30 09:26 - 00828408 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-10-01 02:23 - 2015-10-30 09:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2016-09-27 18:54 - 2015-07-22 21:53 - 00000000 ____D C:\ProgramData\GRETECH
2016-09-27 18:54 - 2015-07-22 21:52 - 00001270 _____ C:\Users\ntb\AppData\Roaming\Microsoft\Windows\Start Menu\GOM Player.lnk
2016-09-27 18:54 - 2015-07-22 21:52 - 00000000 ____D C:\Program Files (x86)\GRETECH
2016-09-26 21:30 - 2014-08-04 18:14 - 00000000 ____D C:\Users\ntb\AppData\Roaming\Skype

==================== Files in the root of some directories =======

2014-12-20 22:32 - 2015-12-10 08:41 - 0000040 _____ () C:\Users\ntb\AppData\Roaming\cdr.ini
2015-01-08 11:49 - 2015-02-17 14:43 - 0000032 _____ () C:\Users\ntb\AppData\Roaming\msboeqi.dat
2015-01-08 11:49 - 2015-01-08 11:49 - 0008604 _____ () C:\Users\ntb\AppData\Roaming\msxmsqvl.dat
2015-01-22 08:44 - 2015-01-22 08:44 - 0074889 _____ () C:\Users\ntb\AppData\Local\084AE95F_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000265 _____ () C:\Users\ntb\AppData\Local\084AE95F_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 0138335 _____ () C:\Users\ntb\AppData\Local\205CED23_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000314 _____ () C:\Users\ntb\AppData\Local\205CED23_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 1517409 _____ () C:\Users\ntb\AppData\Local\4461A4D8_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000263 _____ () C:\Users\ntb\AppData\Local\4461A4D8_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 0103560 _____ () C:\Users\ntb\AppData\Local\516B3EA5_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000290 _____ () C:\Users\ntb\AppData\Local\516B3EA5_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 1331684 _____ () C:\Users\ntb\AppData\Local\53E9472D_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:02 - 0000126 _____ () C:\Users\ntb\AppData\Local\53E9472D_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 09:05 - 6758400 _____ () C:\Users\ntb\AppData\Local\5D067DA4_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000316 _____ () C:\Users\ntb\AppData\Local\5D067DA4_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 0092702 _____ () C:\Users\ntb\AppData\Local\73A5D503_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000289 _____ () C:\Users\ntb\AppData\Local\73A5D503_stp.CIS.part
2014-04-01 14:58 - 2014-04-01 14:58 - 0000000 _____ () C:\Users\ntb\AppData\Local\AtStart.txt
2014-06-02 19:30 - 2015-07-20 19:08 - 0030208 _____ () C:\Users\ntb\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-01 14:58 - 2014-04-01 14:58 - 0000000 _____ () C:\Users\ntb\AppData\Local\DSwitch.txt
2014-04-01 14:58 - 2014-04-01 14:58 - 0000000 _____ () C:\Users\ntb\AppData\Local\QSwitch.txt
2014-10-06 21:35 - 2014-12-30 08:16 - 0007618 _____ () C:\Users\ntb\AppData\Local\Resmon.ResmonCfg
2015-04-28 22:11 - 2015-07-12 17:09 - 0000041 ___SH () C:\ProgramData\.zreglib
2014-06-10 22:24 - 2014-06-10 22:24 - 0682537 _____ () C:\ProgramData\1402430800.bdinstall.bin
2014-06-10 22:26 - 2014-06-10 22:26 - 0063086 _____ () C:\ProgramData\1402431971.bdinstall.bin
2014-06-10 22:56 - 2014-06-10 22:56 - 0215453 _____ () C:\ProgramData\1402433674.bdinstall.bin
2014-07-07 21:49 - 2014-07-07 21:49 - 0037825 _____ () C:\ProgramData\1404762577.bdinstall.bin
2014-07-07 21:50 - 2014-07-07 21:50 - 0098096 _____ () C:\ProgramData\1404762580.bdinstall.bin

Some files in TEMP:
====================
C:\Users\ntb\AppData\Local\Temp\avgnt.exe


Some zero byte size files/folders:
==========================
C:\Windows\System32\BDSandBoxUH.dll
C:\Windows\System32\BDSandBoxUISkin.dll
C:\Windows\System32\BDSandBoxUISkin32.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-10-14 17:49

==================== End of FRST.txt ============================

Re: Prosim o preventinvku. Dik.

Napsal: 23 říj 2016 16:57
od Rudy
Otevřte poznámkový blok a zkopírujte do něj:
Start
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [598552 2016-06-22] (Oracle Corporation)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {097d7b58-19bb-11e6-9be4-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {2a3524f6-649d-11e6-9bef-18a90581b1a5} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {62218dd4-7ac3-11e6-9bf3-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {6221977a-7ac3-11e6-9bf3-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {622197ea-7ac3-11e6-9bf3-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {6221a3cf-7ac3-11e6-9bf3-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {7433da79-3dfd-11e6-9be8-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {8f78a5e9-e15c-11e5-9bdf-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {8f78ab60-e15c-11e5-9bdf-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {8f78adb9-e15c-11e5-9bdf-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {8f78af05-e15c-11e5-9bdf-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {a221ce63-f6a1-11e5-9be2-00247eee44a0} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\MountPoints2: {a6f8379f-7ab5-11e6-9bf1-00247eee44a0} - "F:\HiSuiteDownLoader.exe"
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)
C:\Program Files (x86)\Skype\Toolbars
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} - No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1364096 2016-05-25] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1687680 2016-05-25] (Microsoft Corporation)
U3 idsvc; no ImagePath
C:\Users\ntb\Downloads\DD06.tmp
C:\Users\ntb\AppData\Local\Temp
Task: {11CAAB93-16ED-4098-9AF6-2F0BE7FD8759} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {20CFB8AC-AEB2-4056-A7DB-ADF9D1801F34} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {265DE3A7-62FE-47C8-9FA8-788B9B824350} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {427841EB-D7B5-4733-9C7C-C142214577DE} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {487E89A8-460E-4612-B53E-AC6307506EE8} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {7527A6A0-EFD0-4B87-87D9-6A9E15581725} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {8E95EE4D-68D6-4C6E-8859-E04F704EBC64} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {A15566FA-32F1-418D-B4C7-B59234215CC3} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {A852DFAA-EF93-451A-997D-3607CC36F74C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {AD2D9300-7A5A-4008-A694-A08E894AA823} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {B78D8388-7D7E-4094-AC67-1750BE348BA7} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
End
Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Re: Prosim o preventinvku. Dik.

Napsal: 23 říj 2016 17:37
od peter19500
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-10-2016
Ran by ntb (administrator) on NTB-PC (23-10-2016 18:21:52)
Running from C:\Users\ntb\Desktop
Loaded Profiles: ntb (Available Profiles: ntb & DefaultAppPool)
Platform: Windows 10 Home Version 1511 (X64) Language: Slovenčina (Slovensko)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ActivIdentity) C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Intel Corporation) C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\AMT\LMS.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
() C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10586.570_none_7645b09c266beb53\TiWorker.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneMusic_3.6.25021.0_x64__8wekyb3d8bbwe\Music.UI.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7369.40791.0_x64__8wekyb3d8bbwe\HxTsr.exe


==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-03] (Synaptics Incorporated)
HKLM\...\Run: [picon] => C:\Program Files (x86)\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe [358936 2009-07-15] (Intel Corporation)
HKLM\...\Run: [SoundMAX] => C:\Program Files (x86)\Analog Devices\SoundMAX\soundmax.exe [3866624 2009-05-18] (Analog Devices, Inc.)
HKLM\...\Run: [acevents] => C:\Program Files\ActivIdentity\ActivClient\acevents.exe [196648 2009-06-03] (ActivIdentity)
HKLM\...\Run: [accrdsub] => C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [483880 2009-06-03] (ActivIdentity)
HKLM-x32\...\Run: [SoundMAXPnP] => C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1314816 2009-05-18] (Analog Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [917584 2016-10-10] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1298504 2014-11-08] (CANON INC.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [318248 2016-01-08] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [60136 2016-08-19] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [KiesPDLR.exe] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1021736 2016-01-08] (Samsung)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1572648 2016-01-08] (Samsung)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2007-06-27] (Nero AG)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-07-13] (TomTom)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [Free Download Manager] => C:\Program Files (x86)\Free Download Manager\fdm.exe [5717584 2015-10-28] (FreeDownloadManager.ORG)
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8891608 2016-07-13] (Piriform Ltd)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64\FileSyncShell64.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64\FileSyncShell64.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64\FileSyncShell64.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncShell.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncShell.dll [2015-12-24] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\ntb\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncShell.dll [2015-12-24] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{4ebd6ac1-c602-411d-acb8-a0fe61a9414f}: [DhcpNameServer] 192.168.2.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131208505197382864&GUID=3114ABCA-E2DE-4105-A3E8-C1669E4C763F
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131208505197624020&GUID=3114ABCA-E2DE-4105-A3E8-C1669E4C763F
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131208505197629640&GUID=3114ABCA-E2DE-4105-A3E8-C1669E4C763F
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\S-1-5-21-1661654331-934488394-3447527496-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> 12618F81508237FF74E655DBBAE976EF URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1661654331-934488394-3447527496-1000 -> {2DC90D8C-5E7D-491E-8E9D-FCF17A803778} URL = hxxp://yandex.com/yandsearch?win=160&clid=1989596&text={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_101\bin\ssv.dll [2016-08-06] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-06] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-08-06] (Oracle Corporation)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll [2015-10-28] (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-06] (Oracle Corporation)
DPF: HKLM-x32 {62789780-B744-11D0-986B-00609731A21D} hxxp://195.28.70.134/kapor2/lib/mgaxctrl.cab

FireFox:
========
FF ProfilePath: C:\Users\ntb\AppData\Roaming\TomTom\HOME\Profiles\4xvsx4bf.default [2015-12-02]
FF Extension: (Map status indicator) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [2015-12-01] [not signed]
FF ProfilePath: C:\Users\ntb\AppData\Roaming\Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457 [2016-10-23]
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457 -> Yahoo®
FF Homepage: Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457 -> hxxps://www.google.sk/
FF Extension: (Flash and Video Download) - C:\Users\ntb\AppData\Roaming\Mozilla\Firefox\Profiles\mu6n94o6.default-1422558027457\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2016-10-10]
FF Extension: (Skype) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-05-25]
FF HKU\S-1-5-21-1661654331-934488394-3447527496-1000\...\Firefox\Extensions: [fdm_ffext@freedownloadmanager.org] - C:\ProgramData\Free Download Manager\Firefox\Extensions\2.1.1
FF Extension: (Free Download Manager extension) - C:\ProgramData\Free Download Manager\Firefox\Extensions\2.1.1 [2016-01-31]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_23_0_0_185.dll [2016-10-12] ()
FF Plugin: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-06] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-06] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_185.dll [2016-10-12] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-06] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-06] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pchfckkccldkbclgdepkaonamkignanh] - hxxp://clients2.google.com/service/update2/crx

Opera:
=======
OPR Session Restore: -> is enabled.
OPR Extension: (MediaPlus) - C:\Users\ntb\AppData\Roaming\Opera Software\Opera Stable\Extensions\fpnoagnjlblajeghmbaejnfhekofbecd [2015-12-11]
OPR Extension: (Youtube to mp3 converter) - C:\Users\ntb\AppData\Roaming\Opera Software\Opera Stable\Extensions\geioidjhliialbjcekeejcodiahfplgb [2014-06-01]
OPR Extension: (YouTube Downloader) - C:\Users\ntb\AppData\Roaming\Opera Software\Opera Stable\Extensions\kclijeogghhkmenkommbnjobhnndpfba [2015-11-16]
OPR Extension: (FVD Video Downloader) - C:\Users\ntb\AppData\Roaming\Opera Software\Opera Stable\Extensions\neacgcjokggofibnbfapeaejhclmpple [2016-09-25]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ac.sharedstore; C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe [277032 2009-06-03] (ActivIdentity)
R2 AEADIFilters; C:\WINDOWS\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [1086040 2016-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [475232 2016-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [475232 2016-10-10] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1489240 2016-10-10] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [324304 2016-08-19] (Avira Operations GmbH & Co. KG)
R2 BcmBtRSupport; C:\WINDOWS\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [192200 2016-08-26] ()
R2 LMS; C:\Program Files (x86)\Intel\AMT\LMS.exe [174616 2009-07-15] (Intel Corporation)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [279848 2007-06-27] (Nero AG)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.)
R2 UNS; C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2058776 2009-07-15] (Intel Corporation)
S3 vmicvss; C:\WINDOWS\System32\ICSvc.dll [511488 2016-09-07] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364456 2016-09-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-09-07] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [149832 2016-10-10] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-29] (AVG Technologies)
R1 avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [153392 2016-10-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [35488 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\WINDOWS\system32\DRIVERS\avnetflt.sys [78208 2016-05-14] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\WINDOWS\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R3 BTHprint; C:\WINDOWS\system32\DRIVERS\bthprint.sys [65536 2015-10-30] (Microsoft Corporation)
S3 dtlitescsibus; C:\WINDOWS\System32\DRIVERS\dtlitescsibus.sys [30264 2015-07-12] (Disc Soft Ltd)
R3 ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R3 ElbyCDFL; C:\Windows\SysWOW64\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R3 HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [19000 2010-02-25] (Hewlett-Packard Company)
S3 HWHandSet; C:\WINDOWS\system32\DRIVERS\hw_quusbmdm.sys [223232 2016-05-25] (Huawei Technologies Co., Ltd.)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2016-05-25] (Huawei Technologies Co., Ltd.)
R3 rismcx64; C:\WINDOWS\system32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.)
S3 ssceserd; C:\WINDOWS\system32\DRIVERS\ssceserd.sys [158024 2015-05-21] (MCCI Corporation)
S3 VBoxUSB; C:\WINDOWS\System32\Drivers\VBoxUSB.sys [113952 2014-02-25] (Oracle Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-10-23 18:11 - 2016-10-23 18:12 - 00015571 _____ C:\Users\ntb\Desktop\Fixlog.txt
2016-10-22 20:16 - 2016-10-22 20:22 - 00000000 ____D C:\Users\ntb\Desktop\pneu
2016-10-22 20:16 - 2016-10-22 20:16 - 00000000 ____D C:\Users\ntb\Desktop\Nový priečinok (5)
2016-10-22 09:39 - 2016-10-23 18:21 - 00018928 _____ C:\Users\ntb\Desktop\FRST.txt
2016-10-22 09:38 - 2016-10-22 09:38 - 00000000 ____D C:\Users\ntb\Desktop\FRST-OlderVersion
2016-10-19 19:09 - 2016-10-19 19:09 - 03910208 _____ C:\Users\ntb\Desktop\adwcleaner_6.030.exe
2016-10-16 20:47 - 2016-10-16 20:47 - 00006861 _____ C:\Users\ntb\Desktop\Addition.rar
2016-10-16 20:05 - 2016-10-23 17:13 - 00042613 _____ C:\Users\ntb\Desktop\Addition.txt
2016-10-16 20:01 - 2016-10-23 18:21 - 00000000 ____D C:\FRST
2016-10-16 19:30 - 2016-10-22 09:38 - 02407424 _____ (Farbar) C:\Users\ntb\Desktop\FRST64.exe
2016-10-16 15:51 - 2016-10-16 15:52 - 01412765 _____ (neftojpg.com ) C:\Users\ntb\Downloads\neftojpg_setup.exe
2016-10-12 18:23 - 2016-10-05 09:56 - 01644736 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-10-12 18:23 - 2016-10-05 09:56 - 01242304 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2016-10-12 18:23 - 2016-10-05 09:56 - 00602304 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2016-10-12 18:23 - 2016-10-05 09:56 - 00591040 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2016-10-12 18:23 - 2016-10-05 09:56 - 00144576 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-10-12 18:23 - 2016-10-05 09:56 - 00085696 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-10-12 18:23 - 2016-10-05 09:01 - 01637216 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2016-10-12 18:23 - 2016-10-05 06:10 - 00784384 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-10-12 18:23 - 2016-10-05 06:10 - 00602624 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-10-12 18:23 - 2016-10-05 05:48 - 02437120 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2016-10-12 18:23 - 2016-10-05 05:10 - 00687616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-10-12 18:23 - 2016-10-05 05:09 - 00501760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-10-12 18:23 - 2016-10-05 04:55 - 04895232 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-10-12 18:23 - 2016-10-05 04:50 - 22379520 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-10-12 18:23 - 2016-10-05 04:50 - 11545088 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-10-12 18:23 - 2016-10-05 04:39 - 24611328 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-10-12 18:23 - 2016-10-05 04:33 - 14255104 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2016-10-12 18:23 - 2016-10-05 04:27 - 09920512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-10-12 18:23 - 2016-10-05 04:26 - 07836672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-10-12 18:23 - 2016-10-05 04:13 - 19349504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-10-12 18:23 - 2016-10-05 04:13 - 18675200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-10-12 18:23 - 2016-10-05 04:06 - 12587008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2016-10-12 18:23 - 2016-10-05 04:01 - 05660160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-10-12 18:23 - 2016-09-17 09:45 - 02610176 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2016-10-12 18:23 - 2016-09-17 08:45 - 06312448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2016-10-12 18:23 - 2016-09-17 08:22 - 04405248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2016-10-12 18:22 - 2016-10-05 09:56 - 00329920 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2016-10-12 18:22 - 2016-10-05 09:56 - 00290496 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2016-10-12 18:22 - 2016-10-05 09:20 - 01030408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-10-12 18:22 - 2016-10-05 09:20 - 00875480 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-10-12 18:22 - 2016-10-05 09:19 - 00129376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tm.sys
2016-10-12 18:22 - 2016-10-05 09:18 - 07468384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-10-12 18:22 - 2016-10-05 09:18 - 01317640 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-10-12 18:22 - 2016-10-05 09:18 - 01142560 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-10-12 18:22 - 2016-10-05 09:01 - 01337184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2016-10-12 18:22 - 2016-10-05 08:54 - 01297760 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2016-10-12 18:22 - 2016-10-05 08:17 - 03693064 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-10-12 18:22 - 2016-10-05 08:15 - 00304752 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe
2016-10-12 18:22 - 2016-10-05 08:14 - 22561256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-10-12 18:22 - 2016-10-05 08:09 - 00604920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-10-12 18:22 - 2016-10-05 07:45 - 00987488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2016-10-12 18:22 - 2016-10-05 07:39 - 01988448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-10-12 18:22 - 2016-10-05 07:39 - 00576856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2016-10-12 18:22 - 2016-10-05 07:38 - 00636296 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2016-10-12 18:22 - 2016-10-05 07:38 - 00393056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2016-10-12 18:22 - 2016-10-05 07:37 - 00640976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2016-10-12 18:22 - 2016-10-05 07:31 - 00422240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2016-10-12 18:22 - 2016-10-05 07:25 - 00871776 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvstore.dll
2016-10-12 18:22 - 2016-10-05 07:23 - 00305808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpeffects.dll
2016-10-12 18:22 - 2016-10-05 07:08 - 02937896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-10-12 18:22 - 2016-10-05 07:05 - 00256704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe
2016-10-12 18:22 - 2016-10-05 07:01 - 00046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2016-10-12 18:22 - 2016-10-05 07:00 - 00190464 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2016-10-12 18:22 - 2016-10-05 06:51 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe
2016-10-12 18:22 - 2016-10-05 06:50 - 00103936 _____ (Microsoft Corporation) C:\WINDOWS\system32\davclnt.dll
2016-10-12 18:22 - 2016-10-05 06:49 - 00127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnpclean.dll
2016-10-12 18:22 - 2016-10-05 06:49 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2016-10-12 18:22 - 2016-10-05 06:47 - 00103936 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevDispItemProvider.dll
2016-10-12 18:22 - 2016-10-05 06:47 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll
2016-10-12 18:22 - 2016-10-05 06:38 - 00236032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpdxm.dll
2016-10-12 18:22 - 2016-10-05 06:35 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpshell.dll
2016-10-12 18:22 - 2016-10-05 06:34 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2016-10-12 18:22 - 2016-10-05 06:33 - 00546456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2016-10-12 18:22 - 2016-10-05 06:32 - 00538744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2016-10-12 18:22 - 2016-10-05 06:30 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2016-10-12 18:22 - 2016-10-05 06:30 - 00287232 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll
2016-10-12 18:22 - 2016-10-05 06:30 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\adsmsext.dll
2016-10-12 18:22 - 2016-10-05 06:29 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2016-10-12 18:22 - 2016-10-05 06:27 - 00370688 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack_win.dll
2016-10-12 18:22 - 2016-10-05 06:23 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsqmcons.exe
2016-10-12 18:22 - 2016-10-05 06:19 - 00717152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\drvstore.dll
2016-10-12 18:22 - 2016-10-05 06:18 - 00253080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpeffects.dll
2016-10-12 18:22 - 2016-10-05 06:17 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\das.dll
2016-10-12 18:22 - 2016-10-05 06:17 - 00166912 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboveLockAppHost.dll
2016-10-12 18:22 - 2016-10-05 06:15 - 00458240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Enumeration.dll
2016-10-12 18:22 - 2016-10-05 06:07 - 01159168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplicationFrame.dll
2016-10-12 18:22 - 2016-10-05 06:05 - 00841728 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2016-10-12 18:22 - 2016-10-05 06:04 - 01718272 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2016-10-12 18:22 - 2016-10-05 06:02 - 01040896 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-10-12 18:22 - 2016-10-05 06:00 - 01661952 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2016-10-12 18:22 - 2016-10-05 06:00 - 00148992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2016-10-12 18:22 - 2016-10-05 06:00 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2016-10-12 18:22 - 2016-10-05 05:57 - 00268288 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2016-10-12 18:22 - 2016-10-05 05:55 - 03549696 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll
2016-10-12 18:22 - 2016-10-05 05:40 - 03589120 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-10-12 18:22 - 2016-10-05 05:40 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\davclnt.dll
2016-10-12 18:22 - 2016-10-05 05:37 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevDispItemProvider.dll
2016-10-12 18:22 - 2016-10-05 05:37 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll
2016-10-12 18:22 - 2016-10-05 05:30 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpdxm.dll
2016-10-12 18:22 - 2016-10-05 05:29 - 01946112 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2016-10-12 18:22 - 2016-10-05 05:29 - 01728000 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-10-12 18:22 - 2016-10-05 05:28 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpshell.dll
2016-10-12 18:22 - 2016-10-05 05:24 - 00217600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll
2016-10-12 18:22 - 2016-10-05 05:24 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adsmsext.dll
2016-10-12 18:22 - 2016-10-05 05:23 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2016-10-12 18:22 - 2016-10-05 05:15 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AboveLockAppHost.dll
2016-10-12 18:22 - 2016-10-05 05:14 - 03585536 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
2016-10-12 18:22 - 2016-10-05 05:13 - 00368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.dll
2016-10-12 18:22 - 2016-10-05 05:05 - 01467904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2016-10-12 18:22 - 2016-10-05 05:04 - 01390080 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-10-12 18:22 - 2016-10-05 05:04 - 00885248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-10-12 18:22 - 2016-10-05 04:59 - 02362880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll
2016-10-12 18:22 - 2016-10-05 04:54 - 01987584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2016-10-12 18:22 - 2016-10-05 04:40 - 01626112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2016-10-12 18:22 - 2016-10-05 04:39 - 13392384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-10-12 18:22 - 2016-10-05 04:39 - 01500672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-10-12 18:22 - 2016-10-05 04:22 - 03664384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-10-12 18:22 - 2016-10-05 04:13 - 12134400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-10-12 18:22 - 2016-09-27 04:39 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2016-10-12 18:22 - 2016-09-17 10:08 - 01752576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-10-12 18:22 - 2016-09-17 09:28 - 03077120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-10-12 18:22 - 2016-09-17 09:12 - 01526272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-10-12 18:22 - 2016-09-17 08:43 - 02552832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-10-12 18:22 - 2016-06-18 06:55 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll
2016-10-12 18:22 - 2016-06-18 06:51 - 00470528 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2016-10-12 18:22 - 2016-06-18 06:49 - 00175104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll
2016-10-12 18:22 - 2016-06-18 06:45 - 00361472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2016-10-12 18:21 - 2016-10-01 04:16 - 00446124 _____ C:\WINDOWS\system32\ApnDatabase.xml
2016-10-12 16:43 - 2016-10-16 15:43 - 20478656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2016-10-10 18:53 - 2016-10-10 18:53 - 00016629 _____ C:\Users\ntb\Desktop\Faktúra DH 20160009.odt
2016-10-10 18:08 - 2016-10-10 18:06 - 00023640 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avusbflt.sys
2016-10-05 17:52 - 2016-10-05 17:52 - 00000020 ___SH C:\Users\DefaultAppPool\ntuser.ini
2016-10-01 07:12 - 2016-10-05 17:58 - 00000000 ____D C:\WINDOWS\Panther
2016-09-27 18:54 - 2016-09-27 18:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOM
2016-09-27 18:52 - 2016-10-19 20:39 - 00000000 ____D C:\Program Files (x86)\Lavasoft
2016-09-27 18:52 - 2016-10-19 19:18 - 00000000 ____D C:\Users\ntb\AppData\Roaming\Lavasoft
2016-09-27 18:52 - 2016-09-27 18:52 - 00425744 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll
2016-09-27 18:52 - 2016-09-27 18:52 - 00000000 ____D C:\Users\ntb\AppData\Local\Lavasoft
2016-09-27 18:52 - 2016-09-27 18:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2016-09-27 18:51 - 2016-10-19 19:18 - 00000000 ____D C:\ProgramData\Lavasoft
2016-09-27 11:01 - 2016-09-27 11:01 - 00010149 _____ C:\Users\ntb\Desktop\Krakow3.odt
2016-09-27 10:58 - 2016-09-27 11:45 - 00017774 _____ C:\Users\ntb\Desktop\Krakow 2.odt
2016-09-27 10:35 - 2016-09-27 10:35 - 00016484 _____ C:\Users\ntb\Desktop\Krakow.odt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-10-23 18:15 - 2015-12-24 14:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-10-23 18:12 - 2015-10-30 08:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-10-23 18:11 - 2014-08-04 18:13 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-10-23 17:43 - 2014-05-07 22:09 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-10-23 17:20 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-10-23 17:14 - 2015-10-30 09:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-10-23 17:05 - 2014-05-07 20:52 - 00004188 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{80759E2A-3444-42C4-9A53-A99786A935CB}
2016-10-22 21:03 - 2016-04-07 19:43 - 00000892 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
2016-10-22 20:58 - 2015-12-24 17:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2016-10-22 20:54 - 2015-01-08 11:10 - 00000000 ____D C:\Users\ntb\Downloads\Bedne
2016-10-22 07:13 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-10-22 07:13 - 2015-10-30 09:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-10-22 07:04 - 2015-08-18 21:15 - 00003964 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1401652102
2016-10-22 07:04 - 2014-06-01 21:48 - 00000000 ____D C:\Program Files (x86)\Opera
2016-10-22 07:03 - 2014-06-01 21:48 - 00001120 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2016-10-19 21:30 - 2015-08-07 21:25 - 00000000 ____D C:\Users\ntb\AppData\Local\Packages
2016-10-19 21:29 - 2015-10-30 09:21 - 00000000 ____D C:\WINDOWS\INF
2016-10-19 21:08 - 2015-12-24 10:40 - 01008216 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-10-19 21:03 - 2015-08-07 21:26 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-10-19 21:00 - 2015-12-24 10:30 - 00224560 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-10-19 20:55 - 2015-10-30 09:24 - 00000000 ___SD C:\WINDOWS\system32\DiagSvcs
2016-10-19 20:55 - 2015-10-30 09:24 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2016-10-19 20:39 - 2014-09-03 20:01 - 00000000 ____D C:\AdwCleaner
2016-10-19 20:09 - 2014-05-11 15:25 - 00000000 ____D C:\Users\ntb\Documents\Hifi
2016-10-19 20:05 - 2014-11-30 15:42 - 00000000 ____D C:\Users\ntb\Documents\Amaterske radio
2016-10-16 19:53 - 2015-12-24 10:41 - 00000000 ____D C:\Users\ntb
2016-10-16 15:43 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2016-10-16 15:43 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\Macromed
2016-10-16 15:43 - 2014-05-07 22:09 - 00003820 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-10-16 15:22 - 2014-05-07 20:20 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-10-14 17:13 - 2014-05-14 18:32 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-10-14 17:13 - 2014-05-14 18:32 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-10-14 17:12 - 2014-05-07 21:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-10-13 18:29 - 2014-05-07 20:20 - 143495576 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-10-13 18:20 - 2014-05-14 18:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-10-13 18:12 - 2015-11-08 16:32 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-10-13 18:12 - 2014-12-28 13:40 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-10-10 20:19 - 2015-11-18 12:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-10-10 20:19 - 2014-05-07 21:21 - 00001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-10-10 18:09 - 2016-05-14 12:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-10-10 18:06 - 2015-02-26 14:17 - 00153392 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2016-10-10 18:06 - 2015-02-26 14:17 - 00149832 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2016-10-05 17:52 - 2015-12-24 10:41 - 00000000 ____D C:\Users\DefaultAppPool
2016-10-05 17:39 - 2016-07-17 00:47 - 00000000 ___HD C:\$WINDOWS.~BT
2016-10-01 02:23 - 2015-10-30 09:26 - 00828408 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-10-01 02:23 - 2015-10-30 09:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2016-09-27 18:54 - 2015-07-22 21:53 - 00000000 ____D C:\ProgramData\GRETECH
2016-09-27 18:54 - 2015-07-22 21:52 - 00001270 _____ C:\Users\ntb\AppData\Roaming\Microsoft\Windows\Start Menu\GOM Player.lnk
2016-09-27 18:54 - 2015-07-22 21:52 - 00000000 ____D C:\Program Files (x86)\GRETECH
2016-09-26 21:30 - 2014-08-04 18:14 - 00000000 ____D C:\Users\ntb\AppData\Roaming\Skype

==================== Files in the root of some directories =======

2014-12-20 22:32 - 2015-12-10 08:41 - 0000040 _____ () C:\Users\ntb\AppData\Roaming\cdr.ini
2015-01-08 11:49 - 2015-02-17 14:43 - 0000032 _____ () C:\Users\ntb\AppData\Roaming\msboeqi.dat
2015-01-08 11:49 - 2015-01-08 11:49 - 0008604 _____ () C:\Users\ntb\AppData\Roaming\msxmsqvl.dat
2015-01-22 08:44 - 2015-01-22 08:44 - 0074889 _____ () C:\Users\ntb\AppData\Local\084AE95F_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000265 _____ () C:\Users\ntb\AppData\Local\084AE95F_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 0138335 _____ () C:\Users\ntb\AppData\Local\205CED23_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000314 _____ () C:\Users\ntb\AppData\Local\205CED23_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 1517409 _____ () C:\Users\ntb\AppData\Local\4461A4D8_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000263 _____ () C:\Users\ntb\AppData\Local\4461A4D8_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 0103560 _____ () C:\Users\ntb\AppData\Local\516B3EA5_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000290 _____ () C:\Users\ntb\AppData\Local\516B3EA5_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 1331684 _____ () C:\Users\ntb\AppData\Local\53E9472D_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:02 - 0000126 _____ () C:\Users\ntb\AppData\Local\53E9472D_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 09:05 - 6758400 _____ () C:\Users\ntb\AppData\Local\5D067DA4_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000316 _____ () C:\Users\ntb\AppData\Local\5D067DA4_stp.CIS.part
2015-01-22 08:44 - 2015-01-22 08:44 - 0092702 _____ () C:\Users\ntb\AppData\Local\73A5D503_stp.CIS
2015-01-22 08:44 - 2015-01-22 09:03 - 0000289 _____ () C:\Users\ntb\AppData\Local\73A5D503_stp.CIS.part
2014-04-01 14:58 - 2014-04-01 14:58 - 0000000 _____ () C:\Users\ntb\AppData\Local\AtStart.txt
2014-06-02 19:30 - 2015-07-20 19:08 - 0030208 _____ () C:\Users\ntb\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-01 14:58 - 2014-04-01 14:58 - 0000000 _____ () C:\Users\ntb\AppData\Local\DSwitch.txt
2014-04-01 14:58 - 2014-04-01 14:58 - 0000000 _____ () C:\Users\ntb\AppData\Local\QSwitch.txt
2014-10-06 21:35 - 2014-12-30 08:16 - 0007618 _____ () C:\Users\ntb\AppData\Local\Resmon.ResmonCfg
2015-04-28 22:11 - 2015-07-12 17:09 - 0000041 ___SH () C:\ProgramData\.zreglib
2014-06-10 22:24 - 2014-06-10 22:24 - 0682537 _____ () C:\ProgramData\1402430800.bdinstall.bin
2014-06-10 22:26 - 2014-06-10 22:26 - 0063086 _____ () C:\ProgramData\1402431971.bdinstall.bin
2014-06-10 22:56 - 2014-06-10 22:56 - 0215453 _____ () C:\ProgramData\1402433674.bdinstall.bin
2014-07-07 21:49 - 2014-07-07 21:49 - 0037825 _____ () C:\ProgramData\1404762577.bdinstall.bin
2014-07-07 21:50 - 2014-07-07 21:50 - 0098096 _____ () C:\ProgramData\1404762580.bdinstall.bin

Some zero byte size files/folders:
==========================
C:\Windows\System32\BDSandBoxUH.dll
C:\Windows\System32\BDSandBoxUISkin.dll
C:\Windows\System32\BDSandBoxUISkin32.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-10-14 17:49

==================== End of FRST.txt ============================

Re: Prosim o preventinvku. Dik.

Napsal: 23 říj 2016 18:13
od Rudy
Smazáno, log je již OK.

Re: Prosim o preventinvku. Dik.

Napsal: 23 říj 2016 19:21
od peter19500
Veľmi pekne ďakujem.
Peter

Re: Prosim o preventinvku. Dik.

Napsal: 23 říj 2016 19:32
od Rudy
Nemáte zač! :)
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz