virus/malware
Napsal: 13 dub 2017 16:12
Dobrý den, prosím o kontrolu logu - přestala fungovat wifi, tlačítko start taky nereaguje, nelze se vrátit přes bod obnovení do miunlosti. Použil jsem MBAM, pr věcí jsem tím odstranil, bohužel bez úspěchu. Předem děkuju.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
Ran by viceníci (administrator) on LENOVO-PC (13-04-2017 17:02:23)
Running from C:\Users\klara_000\Desktop
Loaded Profiles: viceníci (Available Profiles: viceníci)
Platform: Windows 10 Home Version 1607 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Memeo) C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
(PS Media s.r.o.) C:\Windows\SysWOW64\ssins.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Realtek semiconductor) C:\Windows\RTFTrack.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
() C:\Users\klara_000\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
() C:\Users\klara_000\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.523\SSScheduler.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
(Overwolf LTD) C:\Program Files (x86)\Overwolf\Overwolf.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.103.44.0\OverwolfHelper.exe
(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.103.44.0\OverwolfHelper64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.313.10010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1703.601.0_x64__8wekyb3d8bbwe\Calculator.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.17022.10301.0_x64__8wekyb3d8bbwe\Music.UI.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17022.10311.0_x64__8wekyb3d8bbwe\Video.UI.exe
() C:\Program Files\WindowsApps\Microsoft.Getstarted_5.0.13.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(forum.viry.cz) C:\Users\klara_000\Desktop\FRSTLauncher.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\MMLoadDrvPXDiscrete.exe
(Microsoft® Windows® Operating System) C:\Windows\System32\Taskmgr.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [6340312 2013-07-19] (Realtek semiconductor)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [935104 2014-11-25] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17111056 2014-05-19] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [193008 2014-05-19] (Lenovo(beijing) Limited)
HKLM\...\Run: [CNAP2 Launcher] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE [226784 2010-01-11] (CANON INC.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3944136 2015-06-03] (Synaptics Incorporated)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-07] (Microsoft Corporation)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [8027016 2016-11-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKLM-x32\...\Run: [StartCCC] => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-07] (CyberLink Corp.)
HKLM-x32\...\Run: [seznam-listicka-distribuce] => C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [1062472 2013-05-16] ()
HKLM-x32\...\Run: [WindowsDriverScan86] => C:\Program Files (x86)\Adobe Arkalis\Arkalis86.lnk [1501 2014-08-10] ()
HKLM-x32\...\Run: [WindowsDriverScan64] => C:\Program Files (x86)\Adobe Arkalis\Arkalis.lnk [1419 2014-08-10] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-03-07] (Oracle Corporation)
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\Run: [cz.seznam.software.autoupdate] => C:\Users\klara_000\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\Run: [cz.seznam.software.szndesktop] => C:\Users\klara_000\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [103080 2015-05-26] ()
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1058360 2017-03-21] ()
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53123712 2016-05-17] (Skype Technologies S.A.)
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\MountPoints2: {3d92fed9-18a0-11e7-83d0-201a06f60ee4} - "F:\autorun.exe"
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\MountPoints2: {618938a8-709c-11e6-8366-0cd292a5e5a0} - "G:\Lenovo_Suite.exe"
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\MountPoints2: {d045982d-cf4f-11e6-83b7-0cd292a5e5a0} - "F:\autorun.exe"
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2017-04-03]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.523\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WDDMStatus.lnk [2014-10-21]
ShortcutTarget: WDDMStatus.lnk -> C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (WDC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WDSmartWare.lnk [2014-10-21]
ShortcutTarget: WDSmartWare.lnk -> C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe (Western Digital)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: 0.0.0.1 mssplus.mcafee.com
Tcpip\Parameters: [DhcpNameServer] 10.146.210.222 10.146.254.253
Tcpip\..\Interfaces\{14268641-5768-4c94-bc6b-eaf509585205}: [DhcpNameServer] 10.146.210.222 10.146.254.253
Tcpip\..\Interfaces\{1fac8850-0822-45e7-9acc-fc3ed21f977a}: [DhcpNameServer] 10.146.210.222 10.146.254.253
Internet Explorer:
==================
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
URLSearchHook: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 - (No Name) - {93a3111f-4f74-4ed8-895e-d9708497629e} - C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll No File
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> DefaultScope {1A45903F-EA21-4BB8-9B36-C9854D3B7DB3} URL =
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {1A45903F-EA21-4BB8-9B36-C9854D3B7DB3} URL =
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {37FFB530-A647-4727-AA75-A0D785444465} URL = hxxp://search.seznam.cz/?q={searchTerms}&sourceid=QuickSearch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {47F727CF-C297-4411-A6F0-2D68350BBE06} URL = hxxp://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {53706E5C-2D32-4ED9-94CB-15FEE0E80527} URL = hxxp://www.firmy.cz/?q={searchTerms}&sourceid= ... arch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {6E7057B2-B42F-462F-A81C-BF65AEFBCF1F} URL = hxxp://slovnik.seznam.cz/?q={searchTerms}&lang=en_cz&sourceid=QuickSearch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {764ED885-E06B-46D8-953B-37C24CDD722B} URL = hxxp://www.zbozi.cz/?q={searchTerms}&r=campmoz ... arch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {7D252221-CAF1-4B29-B357-B4D91BEBC984} URL = hxxp://www.novinky.cz/hledej?w={searchTerms}&s ... arch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {9CDFA569-14BB-4B88-A243-581E287B64D4} URL = hxxp://slovnik.seznam.cz/?q={searchTerms}&lang=cz_en&sourceid=QuickSearch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {B16B9EAA-3D7B-4879-AE27-416BC70FF145} URL = hxxp://encyklopedie.seznam.cz/search?q={searchTerms}&sourceid=QuickSearch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {DE137550-ACE0-40C0-95CF-C980F291C3BC} URL = hxxp://www.mapy.cz/?query={searchTerms}&source ... arch_12454
BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-02-08] (Intel Security)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-31] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-31] (Oracle Corporation)
Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-02-08] (Intel Security)
DPF: HKLM-x32 {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} hxxps://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.96.0.cab
FireFox:
========
FF ProfilePath: C:\Users\klara_000\AppData\Roaming\Mozilla\Firefox\Profiles\hs790l73.default [2017-04-12]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\hs790l73.default -> Ask Web Search
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\hs790l73.default -> Ask Web Search
FF Homepage: Mozilla\Firefox\Profiles\hs790l73.default -> hxxps://www.seznam.cz/
FF Keyword.URL: Mozilla\Firefox\Profiles\hs790l73.default -> hxxp://int.search.tb.ask.com/search/GGmain.jhtml?st=kwd&ptb=74336473-82B7-4646-88B5-406FFEFEB3A7&n=781c0502&ind=2015102210&p2=^HJ^xdm007^YYA^cz&si=CLDO67_11sgCFQrhGwodenANhQ&searchfor=
FF Extension: (Battlefield Play4Free) - C:\Users\klara_000\AppData\Roaming\Mozilla\Firefox\Profiles\hs790l73.default\Extensions\battlefieldplay4free@ea.com [2014-12-03] [not signed]
FF Extension: (Search App by Ask) - C:\Users\klara_000\AppData\Roaming\Mozilla\Firefox\Profiles\hs790l73.default\Extensions\toolbar_ORJ-SPE@apn.ask.com.xpi [2017-01-26]
FF Extension: (Seznam lištička) - C:\Users\klara_000\AppData\Roaming\Mozilla\Firefox\Profiles\hs790l73.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2017-04-07]
FF SearchPlugin: C:\Users\klara_000\AppData\Roaming\Mozilla\Firefox\Profiles\hs790l73.default\searchplugins\ask-search.xml [2015-03-31]
FF SearchPlugin: C:\Users\klara_000\AppData\Roaming\Mozilla\Firefox\Profiles\hs790l73.default\searchplugins\ask-web-search.xml [2015-10-22]
FF Extension: (Site Deployment Checker) - C:\Program Files\Mozilla Firefox\browser\features\deployment-checker@mozilla.org.xpi [2017-03-24] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-24] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-24] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll [2015-01-09] (Adobe Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-08-08] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-08-08] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-31] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-31] (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1071084066-1248797906-2185764281-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\klara_000\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2016-07-14] (Unity Technologies ApS)
Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default [2017-04-12]
CHR Extension: (Dokumenty Google) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-26]
CHR Extension: (Disk Google) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-24]
CHR Extension: (YouTube) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
CHR Extension: (Vyhledávání Google) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-03-24]
CHR Extension: (Dokumenty Google offline) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-31]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-04-08]
CHR Extension: (Gmail) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-08-22]
CHR Extension: (Chrome Media Router) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-09]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [155016 2016-11-21] ()
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-03] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-08-02] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-08-08] (Intel Corporation)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272776 2014-09-03] ()
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.523\McCHSvc.exe [404376 2017-03-20] (McAfee, Inc.)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1325384 2017-03-21] (Overwolf LTD)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 ssinstall; C:\WINDOWS\SysWoW64\ssins.exe [4696960 2016-12-10] (PS Media s.r.o.)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [249032 2015-06-03] (Synaptics Incorporated)
R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [996824 2017-02-06] (McAfee, Inc.)
R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16248 2017-02-06] (McAfee, Inc.)
S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2017-02-06] (McAfee, Inc.)
R2 WDDMService; C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [130048 2010-01-21] (WDC) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WDSmartWareBackgroundService; C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [20480 2009-06-16] (Memeo) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S2 InstallerService; C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe -originalversion 4.4.127.0 [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 amdkmdag; C:\WINDOWS\System32\DriverStore\FileRepository\c0309377.inf_amd64_7ab08912e1e1da0a\atikmdag.sys [26568848 2017-01-25] (Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\WINDOWS\System32\DriverStore\FileRepository\c0309377.inf_amd64_7ab08912e1e1da0a\atikmpag.sys [536600 2017-01-25] (Advanced Micro Devices, Inc.)
R0 amdkmpfd; C:\WINDOWS\System32\drivers\amdkmpfd.sys [36096 2013-05-21] (Advanced Micro Devices, Inc.)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [251832 2017-04-13] (Malwarebytes)
R3 MEIx64; C:\WINDOWS\system32\DRIVERS\TeeDriverx64.sys [99288 2013-08-08] (Intel Corporation)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
S3 NETwNe64; C:\WINDOWS\System32\drivers\NETwew01.sys [3343872 2016-07-16] (Intel Corporation)
R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [8247640 2013-07-19] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [42696 2015-06-03] (Synaptics Incorporated)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [151184 2016-07-15] (MBB)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
S3 wsvd; C:\WINDOWS\system32\DRIVERS\wsvd.sys [102376 2012-06-14] ("CyberLink)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-04-13 17:02 - 2017-04-13 17:03 - 00023104 _____ C:\Users\klara_000\Desktop\FRST.txt
2017-04-13 17:00 - 2017-04-13 17:02 - 00000000 ____D C:\FRST
2017-04-13 16:58 - 2017-04-13 16:58 - 00112640 _____ (forum.viry.cz) C:\Users\klara_000\Desktop\FRSTLauncher.exe
2017-04-13 16:57 - 2017-04-13 16:57 - 02424832 _____ (Farbar) C:\Users\klara_000\Desktop\FRST64.exe
2017-04-12 21:26 - 2017-04-12 21:26 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2017-04-12 21:16 - 2017-04-13 06:57 - 00251832 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-04-12 21:16 - 2017-04-12 21:16 - 00001923 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-04-12 21:16 - 2017-04-12 21:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-04-12 21:16 - 2017-03-24 04:10 - 00077440 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-04-12 21:15 - 2017-04-12 21:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-04-12 21:15 - 2017-04-12 21:15 - 00000000 ____D C:\Program Files\Malwarebytes
2017-04-12 21:13 - 2017-04-12 21:15 - 59272008 _____ (Malwarebytes ) C:\Users\klara_000\Desktop\mb3-setup-consumer-3.0.6.1469-1096.exe
2017-04-12 09:02 - 2017-04-12 09:02 - 00000354 _____ C:\Users\klara_000\Desktop\Wi-Fi – zástupce.lnk
2017-04-12 08:55 - 2017-04-12 08:56 - 00417316 _____ C:\WINDOWS\Minidump\041217-26734-01.dmp
2017-04-11 17:29 - 2017-04-11 17:30 - 00417084 _____ C:\WINDOWS\Minidump\041117-32656-01.dmp
2017-04-11 10:37 - 2017-04-11 10:37 - 00417308 _____ C:\WINDOWS\Minidump\041117-26906-01.dmp
2017-04-10 18:34 - 2017-04-10 18:34 - 04025200 _____ C:\Users\klara_000\Downloads\20170409_002.m4a
2017-04-10 18:34 - 2017-04-10 18:34 - 03319992 _____ C:\Users\klara_000\Downloads\20170409_001.m4a
2017-04-10 15:25 - 2017-04-10 15:27 - 00417164 _____ C:\WINDOWS\Minidump\041017-39656-01.dmp
2017-04-10 13:18 - 2017-04-10 13:21 - 00417628 _____ C:\WINDOWS\Minidump\041017-34796-01.dmp
2017-04-08 20:44 - 2017-04-08 20:44 - 00000000 __SHD C:\found.001
2017-04-08 20:44 - 2017-04-08 20:44 - 00000000 __SHD C:\found.000
2017-04-08 20:32 - 2017-04-08 20:32 - 00417204 _____ C:\WINDOWS\Minidump\040817-32015-01.dmp
2017-04-08 16:18 - 2017-04-12 12:55 - 00000000 ____D C:\Users\klara_000\AppData\LocalLow\Mozilla
2017-04-08 16:17 - 2017-04-08 16:17 - 00001016 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-04-08 16:17 - 2017-04-08 16:17 - 00001004 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-04-08 16:17 - 2017-04-08 16:17 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-04-08 16:17 - 2017-04-08 16:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-04-08 16:12 - 2017-04-08 16:16 - 47440664 _____ C:\Users\klara_000\Downloads\Firefox Setup 52.0.2.exe
2017-04-08 16:11 - 2017-04-08 16:11 - 00000017 _____ C:\Users\klara_000\AppData\Local\resmon.resmoncfg
2017-04-08 09:43 - 2017-04-08 09:44 - 00417244 _____ C:\WINDOWS\Minidump\040817-42921-01.dmp
2017-04-04 08:40 - 2017-04-04 09:05 - 00000000 ____D C:\Users\klara_000\Desktop\mobil
2017-04-03 22:36 - 2017-04-03 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2017-04-03 21:04 - 2017-04-03 21:05 - 00417100 _____ C:\WINDOWS\Minidump\040317-32578-01.dmp
2017-04-03 08:18 - 2017-04-03 08:18 - 00056431 _____ C:\Users\klara_000\Downloads\24-02-2017_13-37-03.pdf
2017-04-03 08:18 - 2017-04-03 08:18 - 00038615 _____ C:\Users\klara_000\Downloads\24-02-2017_13-35-55.pdf
2017-04-03 08:17 - 2017-04-03 08:18 - 00215575 _____ C:\Users\klara_000\Downloads\24-02-2017_13-38-07.pdf
2017-04-03 08:16 - 2017-04-03 08:16 - 00055965 _____ C:\Users\klara_000\Downloads\vypis-781567(1).pdf
2017-04-01 23:04 - 2017-04-01 23:05 - 00417268 _____ C:\WINDOWS\Minidump\040117-32046-01.dmp
2017-03-20 08:22 - 2017-03-20 08:24 - 00607116 _____ C:\WINDOWS\Minidump\032017-37937-01.dmp
2017-03-15 18:10 - 2017-03-15 18:10 - 00000819 _____ C:\Users\klara_000\Downloads\Plocha – zástupce.lnk
2017-03-14 16:25 - 2017-03-14 16:26 - 01617372 _____ C:\WINDOWS\Minidump\031417-27687-01.dmp
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-04-13 16:52 - 2016-08-04 12:23 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-04-13 16:30 - 2016-07-17 00:25 - 07299132 _____ C:\WINDOWS\system32\perfh005.dat
2017-04-13 16:30 - 2016-07-17 00:25 - 02120114 _____ C:\WINDOWS\system32\perfc005.dat
2017-04-13 16:30 - 2016-04-18 11:19 - 14709620 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-04-13 16:27 - 2014-12-03 20:42 - 00000000 ____D C:\Users\klara_000\AppData\Roaming\Seznam.cz
2017-04-13 07:00 - 2015-07-24 10:56 - 00000000 ____D C:\Users\klara_000\AppData\Local\Overwolf
2017-04-13 06:57 - 2016-08-04 12:50 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-04-13 06:56 - 2016-07-16 08:04 - 01048576 _____ C:\WINDOWS\system32\config\BBI
2017-04-13 06:52 - 2015-03-31 16:20 - 00000000 ____D C:\ProgramData\APN
2017-04-12 21:14 - 2016-07-16 13:45 - 00000000 ____D C:\WINDOWS\INF
2017-04-12 12:44 - 2016-08-04 12:35 - 00000000 ____D C:\Users\klara_000
2017-04-12 10:58 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\registration
2017-04-12 09:05 - 2014-11-14 19:09 - 00000000 ____D C:\Users\klara_000\AppData\Local\ElevatedDiagnostics
2017-04-12 08:55 - 2016-08-07 20:52 - 00000000 ____D C:\WINDOWS\Minidump
2017-04-12 08:55 - 2015-05-26 05:17 - 594014832 _____ C:\WINDOWS\MEMORY.DMP
2017-04-11 17:31 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-04-11 10:37 - 2016-10-29 22:36 - 00000000 ____D C:\Program Files\TrueKey
2017-04-11 09:26 - 2016-10-29 22:50 - 00000000 ____D C:\Program Files (x86)\McAfee
2017-04-10 16:04 - 2016-07-16 13:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-04-10 15:44 - 2016-07-16 13:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-04-08 16:05 - 2014-11-11 18:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-04-08 09:51 - 2014-12-03 20:24 - 00532136 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-04-07 17:52 - 2015-03-31 16:19 - 00000000 ____D C:\Users\klara_000\AppData\Roaming\.minecraft
2017-04-06 15:08 - 2015-01-28 18:34 - 00002283 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-04-06 15:08 - 2015-01-28 18:34 - 00002271 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-04-03 22:36 - 2016-10-29 23:06 - 00000000 ____D C:\Program Files\McAfee Security Scan
2017-04-03 22:36 - 2016-10-29 22:36 - 00002020 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2017-04-03 15:20 - 2015-10-20 19:44 - 00000000 ____D C:\Users\klara_000\Desktop\Klub rodičů
2017-04-03 11:25 - 2014-10-21 21:22 - 00000000 ____D C:\Users\klara_000\Desktop\fotbal- dokumenty
2017-03-25 14:48 - 2015-07-24 10:57 - 00000000 ____D C:\Program Files (x86)\Overwolf
2017-03-24 18:44 - 2016-08-04 12:50 - 00004470 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-03-24 18:44 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-03-24 18:44 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-03-24 18:44 - 2014-10-01 17:52 - 00000000 ____D C:\Users\klara_000\AppData\Local\Adobe
2017-03-24 16:37 - 2015-11-07 14:55 - 00000000 ____D C:\Users\klara_000\Desktop\Dílna
2017-03-23 18:47 - 2016-10-29 22:51 - 00000000 ____D C:\Users\klara_000\AppData\Local\tkdata
2017-03-15 18:52 - 2014-10-02 21:44 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-03-15 18:49 - 2014-10-02 21:44 - 138634176 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
==================== Files in the root of some directories =======
2017-04-08 16:11 - 2017-04-08 16:11 - 0000017 _____ () C:\Users\klara_000\AppData\Local\resmon.resmoncfg
2016-08-04 12:28 - 2016-08-04 12:28 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-01-30 19:28 - 2015-01-30 19:28 - 0001534 _____ () C:\ProgramData\ss.ini
Some files in TEMP:
====================
2016-08-15 07:28 - 2016-08-15 07:28 - 0534528 _____ () C:\Users\klara_000\AppData\Local\Temp\{E638ABC1-0067-474b-A379-87CFE81E7848}.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
==================== MBR and Partition Table ==================
==================== Scheduled Tasks (whitelisted) ==================
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
==================== Alternate Data Streams (whitelisted) ==================
==================== Security Center ==================
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\klara_000\Desktop" je 207236 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
==================== End Of Log ==============================
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
Ran by viceníci (administrator) on LENOVO-PC (13-04-2017 17:02:23)
Running from C:\Users\klara_000\Desktop
Loaded Profiles: viceníci (Available Profiles: viceníci)
Platform: Windows 10 Home Version 1607 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Memeo) C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
(PS Media s.r.o.) C:\Windows\SysWOW64\ssins.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Realtek semiconductor) C:\Windows\RTFTrack.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
() C:\Users\klara_000\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
() C:\Users\klara_000\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.523\SSScheduler.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
(Overwolf LTD) C:\Program Files (x86)\Overwolf\Overwolf.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.103.44.0\OverwolfHelper.exe
(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.103.44.0\OverwolfHelper64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.313.10010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1703.601.0_x64__8wekyb3d8bbwe\Calculator.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.17022.10301.0_x64__8wekyb3d8bbwe\Music.UI.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17022.10311.0_x64__8wekyb3d8bbwe\Video.UI.exe
() C:\Program Files\WindowsApps\Microsoft.Getstarted_5.0.13.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(forum.viry.cz) C:\Users\klara_000\Desktop\FRSTLauncher.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\MMLoadDrvPXDiscrete.exe
(Microsoft® Windows® Operating System) C:\Windows\System32\Taskmgr.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [6340312 2013-07-19] (Realtek semiconductor)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [935104 2014-11-25] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17111056 2014-05-19] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [193008 2014-05-19] (Lenovo(beijing) Limited)
HKLM\...\Run: [CNAP2 Launcher] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE [226784 2010-01-11] (CANON INC.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3944136 2015-06-03] (Synaptics Incorporated)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-07] (Microsoft Corporation)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [8027016 2016-11-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKLM-x32\...\Run: [StartCCC] => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-07] (CyberLink Corp.)
HKLM-x32\...\Run: [seznam-listicka-distribuce] => C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [1062472 2013-05-16] ()
HKLM-x32\...\Run: [WindowsDriverScan86] => C:\Program Files (x86)\Adobe Arkalis\Arkalis86.lnk [1501 2014-08-10] ()
HKLM-x32\...\Run: [WindowsDriverScan64] => C:\Program Files (x86)\Adobe Arkalis\Arkalis.lnk [1419 2014-08-10] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-03-07] (Oracle Corporation)
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\Run: [cz.seznam.software.autoupdate] => C:\Users\klara_000\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\Run: [cz.seznam.software.szndesktop] => C:\Users\klara_000\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [103080 2015-05-26] ()
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1058360 2017-03-21] ()
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53123712 2016-05-17] (Skype Technologies S.A.)
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\MountPoints2: {3d92fed9-18a0-11e7-83d0-201a06f60ee4} - "F:\autorun.exe"
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\MountPoints2: {618938a8-709c-11e6-8366-0cd292a5e5a0} - "G:\Lenovo_Suite.exe"
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\...\MountPoints2: {d045982d-cf4f-11e6-83b7-0cd292a5e5a0} - "F:\autorun.exe"
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2017-04-03]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.523\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WDDMStatus.lnk [2014-10-21]
ShortcutTarget: WDDMStatus.lnk -> C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (WDC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WDSmartWare.lnk [2014-10-21]
ShortcutTarget: WDSmartWare.lnk -> C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe (Western Digital)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: 0.0.0.1 mssplus.mcafee.com
Tcpip\Parameters: [DhcpNameServer] 10.146.210.222 10.146.254.253
Tcpip\..\Interfaces\{14268641-5768-4c94-bc6b-eaf509585205}: [DhcpNameServer] 10.146.210.222 10.146.254.253
Tcpip\..\Interfaces\{1fac8850-0822-45e7-9acc-fc3ed21f977a}: [DhcpNameServer] 10.146.210.222 10.146.254.253
Internet Explorer:
==================
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-1071084066-1248797906-2185764281-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
URLSearchHook: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 - (No Name) - {93a3111f-4f74-4ed8-895e-d9708497629e} - C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll No File
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> DefaultScope {1A45903F-EA21-4BB8-9B36-C9854D3B7DB3} URL =
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {1A45903F-EA21-4BB8-9B36-C9854D3B7DB3} URL =
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {37FFB530-A647-4727-AA75-A0D785444465} URL = hxxp://search.seznam.cz/?q={searchTerms}&sourceid=QuickSearch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {47F727CF-C297-4411-A6F0-2D68350BBE06} URL = hxxp://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {53706E5C-2D32-4ED9-94CB-15FEE0E80527} URL = hxxp://www.firmy.cz/?q={searchTerms}&sourceid= ... arch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {6E7057B2-B42F-462F-A81C-BF65AEFBCF1F} URL = hxxp://slovnik.seznam.cz/?q={searchTerms}&lang=en_cz&sourceid=QuickSearch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {764ED885-E06B-46D8-953B-37C24CDD722B} URL = hxxp://www.zbozi.cz/?q={searchTerms}&r=campmoz ... arch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {7D252221-CAF1-4B29-B357-B4D91BEBC984} URL = hxxp://www.novinky.cz/hledej?w={searchTerms}&s ... arch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {9CDFA569-14BB-4B88-A243-581E287B64D4} URL = hxxp://slovnik.seznam.cz/?q={searchTerms}&lang=cz_en&sourceid=QuickSearch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {B16B9EAA-3D7B-4879-AE27-416BC70FF145} URL = hxxp://encyklopedie.seznam.cz/search?q={searchTerms}&sourceid=QuickSearch_12454
SearchScopes: HKU\S-1-5-21-1071084066-1248797906-2185764281-1001 -> {DE137550-ACE0-40C0-95CF-C980F291C3BC} URL = hxxp://www.mapy.cz/?query={searchTerms}&source ... arch_12454
BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-02-08] (Intel Security)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-31] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-31] (Oracle Corporation)
Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-02-08] (Intel Security)
DPF: HKLM-x32 {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} hxxps://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.96.0.cab
FireFox:
========
FF ProfilePath: C:\Users\klara_000\AppData\Roaming\Mozilla\Firefox\Profiles\hs790l73.default [2017-04-12]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\hs790l73.default -> Ask Web Search
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\hs790l73.default -> Ask Web Search
FF Homepage: Mozilla\Firefox\Profiles\hs790l73.default -> hxxps://www.seznam.cz/
FF Keyword.URL: Mozilla\Firefox\Profiles\hs790l73.default -> hxxp://int.search.tb.ask.com/search/GGmain.jhtml?st=kwd&ptb=74336473-82B7-4646-88B5-406FFEFEB3A7&n=781c0502&ind=2015102210&p2=^HJ^xdm007^YYA^cz&si=CLDO67_11sgCFQrhGwodenANhQ&searchfor=
FF Extension: (Battlefield Play4Free) - C:\Users\klara_000\AppData\Roaming\Mozilla\Firefox\Profiles\hs790l73.default\Extensions\battlefieldplay4free@ea.com [2014-12-03] [not signed]
FF Extension: (Search App by Ask) - C:\Users\klara_000\AppData\Roaming\Mozilla\Firefox\Profiles\hs790l73.default\Extensions\toolbar_ORJ-SPE@apn.ask.com.xpi [2017-01-26]
FF Extension: (Seznam lištička) - C:\Users\klara_000\AppData\Roaming\Mozilla\Firefox\Profiles\hs790l73.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2017-04-07]
FF SearchPlugin: C:\Users\klara_000\AppData\Roaming\Mozilla\Firefox\Profiles\hs790l73.default\searchplugins\ask-search.xml [2015-03-31]
FF SearchPlugin: C:\Users\klara_000\AppData\Roaming\Mozilla\Firefox\Profiles\hs790l73.default\searchplugins\ask-web-search.xml [2015-10-22]
FF Extension: (Site Deployment Checker) - C:\Program Files\Mozilla Firefox\browser\features\deployment-checker@mozilla.org.xpi [2017-03-24] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-24] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-24] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll [2015-01-09] (Adobe Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-08-08] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-08-08] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-31] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-31] (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1071084066-1248797906-2185764281-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\klara_000\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2016-07-14] (Unity Technologies ApS)
Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default [2017-04-12]
CHR Extension: (Dokumenty Google) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-26]
CHR Extension: (Disk Google) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-24]
CHR Extension: (YouTube) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
CHR Extension: (Vyhledávání Google) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-03-24]
CHR Extension: (Dokumenty Google offline) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-31]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-04-08]
CHR Extension: (Gmail) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-08-22]
CHR Extension: (Chrome Media Router) - C:\Users\klara_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-09]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [155016 2016-11-21] ()
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-03] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-08-02] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-08-08] (Intel Corporation)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272776 2014-09-03] ()
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.523\McCHSvc.exe [404376 2017-03-20] (McAfee, Inc.)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1325384 2017-03-21] (Overwolf LTD)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 ssinstall; C:\WINDOWS\SysWoW64\ssins.exe [4696960 2016-12-10] (PS Media s.r.o.)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [249032 2015-06-03] (Synaptics Incorporated)
R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [996824 2017-02-06] (McAfee, Inc.)
R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16248 2017-02-06] (McAfee, Inc.)
S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2017-02-06] (McAfee, Inc.)
R2 WDDMService; C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [130048 2010-01-21] (WDC) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WDSmartWareBackgroundService; C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [20480 2009-06-16] (Memeo) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S2 InstallerService; C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe -originalversion 4.4.127.0 [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 amdkmdag; C:\WINDOWS\System32\DriverStore\FileRepository\c0309377.inf_amd64_7ab08912e1e1da0a\atikmdag.sys [26568848 2017-01-25] (Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\WINDOWS\System32\DriverStore\FileRepository\c0309377.inf_amd64_7ab08912e1e1da0a\atikmpag.sys [536600 2017-01-25] (Advanced Micro Devices, Inc.)
R0 amdkmpfd; C:\WINDOWS\System32\drivers\amdkmpfd.sys [36096 2013-05-21] (Advanced Micro Devices, Inc.)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [251832 2017-04-13] (Malwarebytes)
R3 MEIx64; C:\WINDOWS\system32\DRIVERS\TeeDriverx64.sys [99288 2013-08-08] (Intel Corporation)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
S3 NETwNe64; C:\WINDOWS\System32\drivers\NETwew01.sys [3343872 2016-07-16] (Intel Corporation)
R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [8247640 2013-07-19] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [42696 2015-06-03] (Synaptics Incorporated)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [151184 2016-07-15] (MBB)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
S3 wsvd; C:\WINDOWS\system32\DRIVERS\wsvd.sys [102376 2012-06-14] ("CyberLink)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-04-13 17:02 - 2017-04-13 17:03 - 00023104 _____ C:\Users\klara_000\Desktop\FRST.txt
2017-04-13 17:00 - 2017-04-13 17:02 - 00000000 ____D C:\FRST
2017-04-13 16:58 - 2017-04-13 16:58 - 00112640 _____ (forum.viry.cz) C:\Users\klara_000\Desktop\FRSTLauncher.exe
2017-04-13 16:57 - 2017-04-13 16:57 - 02424832 _____ (Farbar) C:\Users\klara_000\Desktop\FRST64.exe
2017-04-12 21:26 - 2017-04-12 21:26 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2017-04-12 21:16 - 2017-04-13 06:57 - 00251832 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-04-12 21:16 - 2017-04-12 21:16 - 00001923 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-04-12 21:16 - 2017-04-12 21:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-04-12 21:16 - 2017-03-24 04:10 - 00077440 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-04-12 21:15 - 2017-04-12 21:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-04-12 21:15 - 2017-04-12 21:15 - 00000000 ____D C:\Program Files\Malwarebytes
2017-04-12 21:13 - 2017-04-12 21:15 - 59272008 _____ (Malwarebytes ) C:\Users\klara_000\Desktop\mb3-setup-consumer-3.0.6.1469-1096.exe
2017-04-12 09:02 - 2017-04-12 09:02 - 00000354 _____ C:\Users\klara_000\Desktop\Wi-Fi – zástupce.lnk
2017-04-12 08:55 - 2017-04-12 08:56 - 00417316 _____ C:\WINDOWS\Minidump\041217-26734-01.dmp
2017-04-11 17:29 - 2017-04-11 17:30 - 00417084 _____ C:\WINDOWS\Minidump\041117-32656-01.dmp
2017-04-11 10:37 - 2017-04-11 10:37 - 00417308 _____ C:\WINDOWS\Minidump\041117-26906-01.dmp
2017-04-10 18:34 - 2017-04-10 18:34 - 04025200 _____ C:\Users\klara_000\Downloads\20170409_002.m4a
2017-04-10 18:34 - 2017-04-10 18:34 - 03319992 _____ C:\Users\klara_000\Downloads\20170409_001.m4a
2017-04-10 15:25 - 2017-04-10 15:27 - 00417164 _____ C:\WINDOWS\Minidump\041017-39656-01.dmp
2017-04-10 13:18 - 2017-04-10 13:21 - 00417628 _____ C:\WINDOWS\Minidump\041017-34796-01.dmp
2017-04-08 20:44 - 2017-04-08 20:44 - 00000000 __SHD C:\found.001
2017-04-08 20:44 - 2017-04-08 20:44 - 00000000 __SHD C:\found.000
2017-04-08 20:32 - 2017-04-08 20:32 - 00417204 _____ C:\WINDOWS\Minidump\040817-32015-01.dmp
2017-04-08 16:18 - 2017-04-12 12:55 - 00000000 ____D C:\Users\klara_000\AppData\LocalLow\Mozilla
2017-04-08 16:17 - 2017-04-08 16:17 - 00001016 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-04-08 16:17 - 2017-04-08 16:17 - 00001004 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-04-08 16:17 - 2017-04-08 16:17 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-04-08 16:17 - 2017-04-08 16:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-04-08 16:12 - 2017-04-08 16:16 - 47440664 _____ C:\Users\klara_000\Downloads\Firefox Setup 52.0.2.exe
2017-04-08 16:11 - 2017-04-08 16:11 - 00000017 _____ C:\Users\klara_000\AppData\Local\resmon.resmoncfg
2017-04-08 09:43 - 2017-04-08 09:44 - 00417244 _____ C:\WINDOWS\Minidump\040817-42921-01.dmp
2017-04-04 08:40 - 2017-04-04 09:05 - 00000000 ____D C:\Users\klara_000\Desktop\mobil
2017-04-03 22:36 - 2017-04-03 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2017-04-03 21:04 - 2017-04-03 21:05 - 00417100 _____ C:\WINDOWS\Minidump\040317-32578-01.dmp
2017-04-03 08:18 - 2017-04-03 08:18 - 00056431 _____ C:\Users\klara_000\Downloads\24-02-2017_13-37-03.pdf
2017-04-03 08:18 - 2017-04-03 08:18 - 00038615 _____ C:\Users\klara_000\Downloads\24-02-2017_13-35-55.pdf
2017-04-03 08:17 - 2017-04-03 08:18 - 00215575 _____ C:\Users\klara_000\Downloads\24-02-2017_13-38-07.pdf
2017-04-03 08:16 - 2017-04-03 08:16 - 00055965 _____ C:\Users\klara_000\Downloads\vypis-781567(1).pdf
2017-04-01 23:04 - 2017-04-01 23:05 - 00417268 _____ C:\WINDOWS\Minidump\040117-32046-01.dmp
2017-03-20 08:22 - 2017-03-20 08:24 - 00607116 _____ C:\WINDOWS\Minidump\032017-37937-01.dmp
2017-03-15 18:10 - 2017-03-15 18:10 - 00000819 _____ C:\Users\klara_000\Downloads\Plocha – zástupce.lnk
2017-03-14 16:25 - 2017-03-14 16:26 - 01617372 _____ C:\WINDOWS\Minidump\031417-27687-01.dmp
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-04-13 16:52 - 2016-08-04 12:23 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-04-13 16:30 - 2016-07-17 00:25 - 07299132 _____ C:\WINDOWS\system32\perfh005.dat
2017-04-13 16:30 - 2016-07-17 00:25 - 02120114 _____ C:\WINDOWS\system32\perfc005.dat
2017-04-13 16:30 - 2016-04-18 11:19 - 14709620 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-04-13 16:27 - 2014-12-03 20:42 - 00000000 ____D C:\Users\klara_000\AppData\Roaming\Seznam.cz
2017-04-13 07:00 - 2015-07-24 10:56 - 00000000 ____D C:\Users\klara_000\AppData\Local\Overwolf
2017-04-13 06:57 - 2016-08-04 12:50 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-04-13 06:56 - 2016-07-16 08:04 - 01048576 _____ C:\WINDOWS\system32\config\BBI
2017-04-13 06:52 - 2015-03-31 16:20 - 00000000 ____D C:\ProgramData\APN
2017-04-12 21:14 - 2016-07-16 13:45 - 00000000 ____D C:\WINDOWS\INF
2017-04-12 12:44 - 2016-08-04 12:35 - 00000000 ____D C:\Users\klara_000
2017-04-12 10:58 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\registration
2017-04-12 09:05 - 2014-11-14 19:09 - 00000000 ____D C:\Users\klara_000\AppData\Local\ElevatedDiagnostics
2017-04-12 08:55 - 2016-08-07 20:52 - 00000000 ____D C:\WINDOWS\Minidump
2017-04-12 08:55 - 2015-05-26 05:17 - 594014832 _____ C:\WINDOWS\MEMORY.DMP
2017-04-11 17:31 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-04-11 10:37 - 2016-10-29 22:36 - 00000000 ____D C:\Program Files\TrueKey
2017-04-11 09:26 - 2016-10-29 22:50 - 00000000 ____D C:\Program Files (x86)\McAfee
2017-04-10 16:04 - 2016-07-16 13:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-04-10 15:44 - 2016-07-16 13:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-04-08 16:05 - 2014-11-11 18:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-04-08 09:51 - 2014-12-03 20:24 - 00532136 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-04-07 17:52 - 2015-03-31 16:19 - 00000000 ____D C:\Users\klara_000\AppData\Roaming\.minecraft
2017-04-06 15:08 - 2015-01-28 18:34 - 00002283 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-04-06 15:08 - 2015-01-28 18:34 - 00002271 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-04-03 22:36 - 2016-10-29 23:06 - 00000000 ____D C:\Program Files\McAfee Security Scan
2017-04-03 22:36 - 2016-10-29 22:36 - 00002020 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2017-04-03 15:20 - 2015-10-20 19:44 - 00000000 ____D C:\Users\klara_000\Desktop\Klub rodičů
2017-04-03 11:25 - 2014-10-21 21:22 - 00000000 ____D C:\Users\klara_000\Desktop\fotbal- dokumenty
2017-03-25 14:48 - 2015-07-24 10:57 - 00000000 ____D C:\Program Files (x86)\Overwolf
2017-03-24 18:44 - 2016-08-04 12:50 - 00004470 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-03-24 18:44 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-03-24 18:44 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-03-24 18:44 - 2014-10-01 17:52 - 00000000 ____D C:\Users\klara_000\AppData\Local\Adobe
2017-03-24 16:37 - 2015-11-07 14:55 - 00000000 ____D C:\Users\klara_000\Desktop\Dílna
2017-03-23 18:47 - 2016-10-29 22:51 - 00000000 ____D C:\Users\klara_000\AppData\Local\tkdata
2017-03-15 18:52 - 2014-10-02 21:44 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-03-15 18:49 - 2014-10-02 21:44 - 138634176 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
==================== Files in the root of some directories =======
2017-04-08 16:11 - 2017-04-08 16:11 - 0000017 _____ () C:\Users\klara_000\AppData\Local\resmon.resmoncfg
2016-08-04 12:28 - 2016-08-04 12:28 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-01-30 19:28 - 2015-01-30 19:28 - 0001534 _____ () C:\ProgramData\ss.ini
Some files in TEMP:
====================
2016-08-15 07:28 - 2016-08-15 07:28 - 0534528 _____ () C:\Users\klara_000\AppData\Local\Temp\{E638ABC1-0067-474b-A379-87CFE81E7848}.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
==================== MBR and Partition Table ==================
==================== Scheduled Tasks (whitelisted) ==================
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
==================== Alternate Data Streams (whitelisted) ==================
==================== Security Center ==================
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\klara_000\Desktop" je 207236 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
==================== End Of Log ==============================
