VIRY.CZ

Zdravím.
Prosím o kontrolu, počítač si chvílemi dělá co chce.

Logfile of random's system information tool 1.10 (written by random/random)
Run by tereza at 2017-01-20 14:17:01
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 164 GB (65%) free of 251 GB
Total RAM: 3070 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:17:06, on 20.1.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18427)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\OSCAR Editor X7\OscarEditor.exe
C:\Users\tereza\Desktop\ProcessExplorer\procexp.exe
C:\Users\tereza\Downloads\RSIT.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\trend micro\tereza.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_111\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_111\bin\jp2ssv.dll
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKCU\..\Run: [OscarEditor] "C:\Program Files\OSCAR Editor X7\OscarEditor.exe" Minimum
O4 - Global Startup: procexp.exe – zástupce.lnk = C:\Users\tereza\Desktop\ProcessExplorer\procexp.exe
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{515E62B2-68F1-4AA5-A50D-2F20690F38CF}: NameServer = 213.46.172.36,213.46.172.37
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: NVIDIA Display Container LS (NVDisplay.ContainerLocalSystem) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe

--
End of file - 3317 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player PPAPI Notifier.job - C:\Windows\system32\Macromed\Flash\FlashUtil32_24_0_0_194_pepper.exe -check pepperplugin

=========Mozilla firefox=========

ProfilePath - C:\Users\tereza\AppData\Roaming\Mozilla\Firefox\Profiles\uzqr1wdu.default-1484715647151

prefs.js - "browser.startup.homepage" - "https://www.seznam.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 24.0.0.186 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_24_0_0_186.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.111.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.111.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre1.8.0_111\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.2.2]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.2.4]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_111\bin\ssv.dll [2016-11-11 473152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-11-11 186944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2016-11-14 1002984]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2012-06-11 10996368]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OscarEditor"=C:\Program Files\OSCAR Editor X7\OscarEditor.exe [2012-03-20 3340288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19 1160408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2009-02-06 170496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudialsNotifier]
C:\Program Files\Music Recorder\Music Recorder 2016\AudialsNotifier.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring]
C:\Program Files\CCleaner\CCleaner.exe [2016-12-06 7175384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLLSuite2016]
C:\Program Files\DLL Suite\DLLSuite.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-06-24 1840424]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-06-08 2221352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvBackend]
C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OscarEditor]
C:\Program Files\OSCAR Editor X7\OscarEditor.exe [2012-03-20 3340288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2012-06-11 10996368]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StereoLinksInstall]
C:\Program Files\NVIDIA Corporation\3D Vision\nvstlink.exe /install1 []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2016-09-22 587288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
C:\Program Files\Unlocker\UnlockerAssistant.exe [2010-07-04 17408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
C:\Program Files\WinFast\WFDTV\WFWIZ.exe [2010-03-25 2924544]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV]
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe [2010-04-07 79360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^tereza^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
C:\PROGRA~1\MICROS~3\Office12\ONENOTEM.EXE [2009-02-26 97680]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
procexp.exe – zástupce.lnk - C:\Users\tereza\Desktop\ProcessExplorer\procexp.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave9"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2017-01-19 02:28:16 ----A---- C:\Windows\system32\FNTCACHE.DAT
2017-01-18 17:22:20 ----SHD---- C:\Config.Msi
2017-01-18 15:59:09 ----D---- C:\Program Files\Adobe
2017-01-18 15:58:51 ----D---- C:\ProgramData\Adobe
2017-01-18 15:47:55 ----D---- C:\Program Files\VirusTotalUploader2
2017-01-18 02:05:10 ----D---- C:\Program Files\Mozilla Firefox
2017-01-15 06:34:58 ----D---- C:\Program Files\trend micro
2017-01-15 06:34:57 ----D---- C:\rsit
2017-01-14 05:59:06 ----D---- C:\Users\tereza\AppData\Roaming\ArcSoft
2017-01-14 05:58:29 ----D---- C:\ProgramData\ArcSoft
2017-01-14 05:58:25 ----A---- C:\Windows\system32\unicows.dll
2017-01-14 05:58:24 ----D---- C:\Program Files\Common Files\ArcSoft
2017-01-14 05:57:18 ----D---- C:\Program Files\WinFast
2017-01-14 05:51:24 ----A---- C:\Windows\system32\drivers\wfcxxbar.sys
2017-01-14 05:51:24 ----A---- C:\Windows\system32\drivers\wfcxvcap.sys
2017-01-14 05:51:24 ----A---- C:\Windows\system32\drivers\wfcxtcap.sys
2017-01-14 05:51:24 ----A---- C:\Windows\system32\drivers\wfcxdtun.sys
2017-01-14 05:51:24 ----A---- C:\Windows\system32\drivers\wfcxatun.sys
2017-01-14 05:51:24 ----A---- C:\Windows\system32\drivers\wfcxacap.sys
2017-01-02 06:01:29 ----D---- C:\ProgramData\Electronics 2000
2017-01-02 06:01:22 ----D---- C:\Program Files\Electronics 2000
2016-12-27 19:26:51 ----A---- C:\Windows\NvContainerRecovery.bat
2016-12-27 19:26:49 ----A---- C:\Windows\system32\OpenCL.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvwgf2um.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvumdshim.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvptxJitCompiler.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvopencl.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvoglv32.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvoglshim32.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvinit.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\NvIFR.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\NvFBC.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvfatbinaryLoader.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvdispgenco3237633.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvdispco3237633.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvd3dum.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvcuvid.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\nvcuda.dll
2016-12-27 19:25:35 ----A---- C:\Windows\system32\drivers\nvlddmkm.sys
2016-12-27 19:25:34 ----A---- C:\Windows\system32\nvcompiler.dll
2016-12-27 19:25:34 ----A---- C:\Windows\system32\nvapi.dll
2016-12-27 19:15:28 ----A---- C:\Windows\system32\nvsvcr.dll
2016-12-27 19:15:28 ----A---- C:\Windows\system32\nvsvc.dll
2016-12-27 19:15:28 ----A---- C:\Windows\system32\nvshext.dll
2016-12-27 19:15:28 ----A---- C:\Windows\system32\nvcpl.dll
2016-12-27 19:15:28 ----A---- C:\Windows\system32\nv3dappshextr.dll
2016-12-27 19:15:28 ----A---- C:\Windows\system32\nv3dappshext.dll
2016-12-27 19:15:27 ----A---- C:\Windows\system32\nvmctray.dll
2016-12-27 17:06:26 ----A---- C:\Windows\NeroDigital.ini

======List of files/folders modified in the last 1 month======

2017-01-20 14:16:51 ----D---- C:\Windows\temp
2017-01-20 14:01:57 ----D---- C:\Windows\system32\drivers
2017-01-20 14:01:33 ----D---- C:\ProgramData\NVIDIA
2017-01-19 13:21:17 ----RD---- C:\Program Files
2017-01-19 09:18:20 ----D---- C:\Windows\System32
2017-01-19 09:18:20 ----D---- C:\Windows\inf
2017-01-19 09:18:20 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-01-19 08:19:34 ----D---- C:\Windows\SoftwareDistribution
2017-01-19 08:19:33 ----D---- C:\Windows
2017-01-19 08:14:31 ----D---- C:\Windows\Prefetch
2017-01-19 07:30:38 ----SHD---- C:\System Volume Information
2017-01-19 06:44:14 ----RHD---- C:\$RECYCLE.BIN
2017-01-19 04:27:09 ----D---- C:\Windows\system32\LogFiles
2017-01-18 17:23:02 ----SHD---- C:\Windows\Installer
2017-01-18 16:00:08 ----D---- C:\Users\tereza\AppData\Roaming\Adobe
2017-01-18 15:59:59 ----D---- C:\Windows\system32\Tasks
2017-01-18 15:59:09 ----D---- C:\Program Files\Common Files\Adobe
2017-01-18 15:58:51 ----D---- C:\ProgramData
2017-01-18 15:23:01 ----D---- C:\Windows\system32\catroot2
2017-01-18 09:12:45 ----D---- C:\Users\tereza\AppData\Roaming\vlc
2017-01-15 01:49:00 ----D---- C:\Windows\system32\Macromed
2017-01-14 23:22:51 ----A---- C:\Windows\system32\Dvbpws.dll
2017-01-14 14:24:05 ----D---- C:\Windows\Microsoft.NET
2017-01-14 05:59:21 ----HD---- C:\Program Files\InstallShield Installation Information
2017-01-14 05:58:24 ----D---- C:\Program Files\Common Files
2017-01-14 05:57:37 ----D---- C:\Windows\system32\WinFast
2017-01-14 05:52:29 ----D---- C:\Windows\system32\DriverStore
2017-01-14 05:51:38 ----D---- C:\Windows\system32\config
2017-01-14 04:54:34 ----D---- C:\Windows\Logs
2017-01-14 04:23:37 ----RSD---- C:\Windows\assembly
2017-01-14 04:20:58 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2017-01-10 05:53:25 ----D---- C:\Windows\winsxs
2017-01-09 17:19:38 ----D---- C:\Windows\Minidump
2017-01-09 17:04:17 ----D---- C:\Windows\system32\drivers\en-US
2017-01-09 17:04:17 ----D---- C:\Windows\system32\drivers\cs-CZ
2017-01-09 16:40:24 ----D---- C:\Windows\system32\en-US
2017-01-09 16:40:24 ----D---- C:\Windows\system32\cs-CZ
2017-01-09 16:30:44 ----D---- C:\Windows\Tasks
2017-01-09 08:48:07 ----D---- C:\Windows\debug
2017-01-09 07:05:05 ----D---- C:\Windows\system32\catroot
2017-01-08 20:16:30 ----D---- C:\Windows\system32\MRT
2017-01-08 20:14:07 ----AC---- C:\Windows\system32\MRT.exe
2017-01-08 20:13:57 ----D---- C:\ProgramData\Microsoft Help
2017-01-08 20:12:09 ----D---- C:\Program Files\Microsoft Security Client
2017-01-08 20:04:16 ----D---- C:\Program Files\Microsoft Silverlight
2017-01-01 12:41:09 ----D---- C:\Users\tereza\AppData\Roaming\MPC-HC
2017-01-01 03:54:39 ----D---- C:\Users\tereza\AppData\Roaming\dvdcss
2016-12-27 20:12:10 ----D---- C:\ProgramData\NVIDIA Corporation
2016-12-27 20:11:01 ----D---- C:\Program Files\NVIDIA Corporation
2016-12-27 19:27:07 ----D---- C:\Temp
2016-12-27 19:15:25 ----D---- C:\Windows\Help

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2016-08-25 252808]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2011-03-08 173440]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2011-03-08 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2014-08-08 243128]
R1 RawDisk3;RawDisk3; \??\C:\Windows\system32\drivers\rawdsk3.sys [2015-07-24 28088]
R1 wfcxacap;WinFast TV PCI Audio Capture Driver; C:\Windows\system32\DRIVERS\wfcxacap.sys [2007-09-19 9856]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R2 wfcxatun;WinFast TV Analog Tuner Driver; C:\Windows\system32\drivers\wfcxatun.sys [2007-09-19 31744]
R2 WFCXVCAP;WinFast TV Video Capture Driver; C:\Windows\system32\drivers\wfcxvcap.sys [2007-09-19 167040]
R3 EverestDriver;Lavalys EVEREST Kernel Driver; \??\C:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2010-03-30 27760]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2012-06-19 3240400]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2016-08-25 105696]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2014-11-06 162592]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2014-12-10 584920]
R3 wfcxdtun;WinFast DTV BDA Tuner/Demod Driver; C:\Windows\system32\drivers\wfcxdtun.sys [2007-09-19 21248]
R3 wfcxtcap;WinFast DTV BDA Transport Stream Capture Driver; C:\Windows\system32\drivers\wfcxtcap.sys [2007-09-19 15872]
R3 wfcxxbar;WinFast TV Crossbar Driver; C:\Windows\system32\drivers\wfcxxbar.sys [2007-09-19 10496]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 anvsnddrv;AnvSoft Virtual Sound Device; C:\Windows\system32\drivers\anvsnddrv.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 393728]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
S3 catchme;catchme; \??\C:\Users\tereza\AppData\Local\Temp\catchme.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\DRIVERS\dmvsc.sys [2011-03-08 62464]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2014-11-11 17488]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\Windows\system32\drivers\nmwcdnsu.sys [2011-08-17 137472]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad32v.sys [2016-11-11 40384]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2011-03-08 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2015-06-11 15872]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2011-03-08 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\DRIVERS\sisagp.sys []
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2011-03-08 28032]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [2011-03-08 77184]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\DRIVERS\terminpt.sys [2011-03-08 25600]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 49152]
S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%; C:\Windows\system32\DRIVERS\TsUsbGD.sys [2011-03-08 27264]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys [2011-03-08 112640]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\DRIVERS\vmbus.sys [2011-03-08 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2011-03-08 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2011-03-08 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2016-11-14 103696]
R2 NVDisplay.ContainerLocalSystem;NVIDIA Display Container LS; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [2016-12-11 420288]
R3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2016-11-14 280864]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2016-11-29 105144]
S2 gupdate;Služba Aktualizace Google (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2016-11-11 153752]
S3 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2009-02-06 109056]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 gupdatem;Služba Aktualizace Google (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2016-11-11 153752]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service; C:\Windows\system32\IEEtwCollector.exe [2016-08-02 102912]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;BranchCache; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2016-12-19 82640]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2016-11-29 45752]
S4 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-06-08 877864]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2016-11-29 135848]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2016-11-29 135848]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2016-11-29 135848]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-06-24 537896]
S4 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [2006-12-19 81920]
S4 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]
S4 UmRdpService;Přesměrovač portů uživatelského režimu služby Vzdálená plocha; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 vmserve;vmserve Update; C:\Program Files\Common Update\vmserve Update\vmserve.exe {79740E79-A383-47A7-B513-3DF6563D007F} {A16B1AF7-982D-40C3-B5C1-633E1A6A6678} []

-----------------EOF-----------------

Zdravím!
Jak je na tom váš oper. systém s legalitou?

dobře

OK. Udělejete tento sken:

Stáhněte a spusťte OTL: http://oldtimer.geekstogo.com/OTL.exe . Spusťte, zaškrněte "Pro všechny uživatele", Kontrola na havěť LOP" a Kontrola na hvěť PURITY" a do dolního bílého okna zkopírujte:

CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
atapi.sys
autochk.exe
cdrom.sys
explorer.exe
hal.dll
scecli.dll
services.exe
svchost.exe
tcpip.sys
userinit.exe
winlogon.exe
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s

%PROGRAMFILES%\Mozilla Firefox\firefox.exe /md5
%PROGRAMFILES%\Internet Explorer\iexplore.exe /md5
%PROGRAMFILES%\Opera\opera.exe /md5
%PROGRAMFILES%\Google\Chrome\Application\chrome.exe /md5

%SystemDrive%\PhysicalMBR.bin /md5

*crack* /s
*keygen* /s
*loader* /s

a klikněte na >Prohledat<. Dejte oba logy.

OTL už prohledává víc než hodinu, je to normální?

Zkusil jsem několikrát spustit, a vždycky zůstane na řádku:

Pattern Search - Loockinng at folder: C:\user\all user\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data.......

Záleží ne velikosti disku a rychlosti systému.

bohužel logu z OTL jsem se nedočkal

Typ CPU Intel Core 2 Duo E8400, 3384 MHz (9 x 376)
disk 250GB 150 volných

OK. Udělejte tedy kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

Malwarebytes
www.malwarebytes.com

-Podrobnosti logovacího souboru-
Datum skenování: 21.01.17
Čas skenování: 19:33
Logovací soubor: nnnnnnnnnnnnnnnnnnnnnnnnnnn.txt
Správce: Ano

-Informace o softwaru-
Verze: 3.0.5.1299
Verze komponentů: 1.0.43
Aktualizovat verzi balíku komponent: 1.0.1070
Licence: Zkušební

-Systémová informace-
OS: Windows 7 Service Pack 1
CPU: x86
Systém souborů: NTFS
Uživatel: tereza-PC\tereza

-Shrnutí skenování-
Typ skenování: Skenování hrozeb (Threat Scan)
Výsledek: Dokončeno
Skenované objekty: 283377
Uplynulý čas: 4 min, 53 sek

-Možnosti skenování-
Paměť: Povoleno
Start: Povoleno
Systém souborů: Povoleno
Archivy: Povoleno
Rootkity: Zakázáno
Heuristika: Povoleno
Potenciálně nežádoucí program: Povoleno
Potenciálně nežádoucí modifikace: Povoleno

-Podrobnosti skenování-
Proces: 0
(Nebyly zjištěny žádné škodlivé položky)

Modul: 0
(Nebyly zjištěny žádné škodlivé položky)

Klíč registru: 3
PUP.Optional.PCSpeedUp, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\PCSUUCDRV, Žádná uživatelská akce, [7997], [241622],1.0.1070
PUP.Optional.CommonUpdate.PrxySvrRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\VMSERVE, Žádná uživatelská akce, [17857], [256288],1.0.1070
PUP.Optional.CommonUpdate.PrxySvrRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NLASVC\PARAMETERS\INTERNET\MANUALPROXIES, Žádná uživatelská akce, [17857], [-1],0.0.0

Hodnota v registru: 4
PUP.Optional.CommonUpdate.PrxySvrRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\VMSERVE|IMAGEPATH, Žádná uživatelská akce, [17857], [256288],1.0.1070
PUP.Optional.CommonUpdate.PrxySvrRST, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Žádná uživatelská akce, [17857], [-1],0.0.0
PUP.Optional.CommonUpdate.PrxySvrRST, HKU\S-1-5-21-1576492637-22522411-1786018528-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Žádná uživatelská akce, [17857], [-1],0.0.0
PUP.Optional.CommonUpdate.PrxySvrRST, HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Žádná uživatelská akce, [17857], [-1],0.0.0

Datové proudy: 0
(Nebyly zjištěny žádné škodlivé položky)

Adresář: 0
(Nebyly zjištěny žádné škodlivé položky)

Soubor: 2
PUP.Optional.Babylon, C:\USERS\TEREZA\DOWNLOADS\UNLOCKER1.9.2.EXE, Žádná uživatelská akce, [2110], [76260],1.0.1070
PUP.Optional.DownloadGuide, C:\USERS\TEREZA\DOWNLOADS\RESISTORCALCULATOR.EXE, Žádná uživatelská akce, [185], [287622],1.0.1070

Fyzický sektor: 0
(Nebyly zjištěny žádné škodlivé položky)


(end)

Vše, co MBAM nalezl, smažte.