Zamořený PC
Napsal: 14 dub 2017 23:50
Zdravím,
před nedávnem se mi dostal nějakým způsobem do PC prográmek Kyubey.exe .
Dle Vašeho fóra jsem jej po několika pokusech dokázal odstranit. Přesto není vše v pořádku - v prohlížeči se přepisuje startovací stránka, manuálně nejde změnit nastavení prohlížeče, z reportu Hijackthis se mi nezdají určité údaje co by tam neměli být.
Dle návodu zasílám log FRST
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017
Ran by Golfstar (15-04-2017 00:38:49)
Running from C:\Users\Golfstar\Desktop
Windows 10 Pro Version 1511 (X64) (2016-07-23 11:10:22)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1702488835-1983202832-4074137989-500 - Administrator - Disabled)
Bíba (S-1-5-21-1702488835-1983202832-4074137989-1003 - Limited - Enabled) => C:\Users\Bíba
DefaultAccount (S-1-5-21-1702488835-1983202832-4074137989-503 - Limited - Disabled)
Golfstar (S-1-5-21-1702488835-1983202832-4074137989-1001 - Administrator - Enabled) => C:\Users\Golfstar
Guest (S-1-5-21-1702488835-1983202832-4074137989-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1702488835-1983202832-4074137989-1002 - Limited - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avast Antivirus (Disabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Disabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 16.04 (HKLM-x32\...\{23170F69-40C1-2701-1604-000001000000}) (Version: 16.04.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Czech (HKLM-x32\...\{AC76BA86-7AD7-1029-7B44-AC0F074E4100}) (Version: 17.009.20044 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 25.0.0.134 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.148 - Adobe Systems Incorporated)
Adobe Flash Player 25 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 25.0.0.148 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Photoshop CS5 (HKLM-x32\...\{15FEDA5F-141C-4127-8D7E-B962D1742728}) (Version: 12.0 - Adobe Systems Incorporated)
Aktualizace NVIDIA 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
Avast Free Antivirus (HKLM-x32\...\Avast Antivirus) (Version: 17.3.2291 - AVAST Software)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BitRaider Streaming Client (HKLM-x32\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.7.0.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.1.10.15 - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: 4.2.0 - Canon Inc.)
Canon MG2900 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2900_series) (Version: 1.01 - Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 3.5.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 3.5.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.3.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.7.1 - Canon Inc.)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.5.1.0230 - Disc Soft Ltd)
Dropbox (HKU\S-1-5-21-1702488835-1983202832-4074137989-1001\...\Dropbox) (Version: 6.4.14 - Dropbox, Inc.)
EVE Online (HKLM-x32\...\{345CEED5-9EAD-41BE-A90F-F3F4B85BABAF}) (Version: 3.0.0 - CCP Games Ltd.)
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Gameforge Live 2.0.6 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.6 - Gameforge)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.33.3 - Google Inc.) Hidden
Happy Cloud Client (HKU\S-1-5-21-1702488835-1983202832-4074137989-1001\...\HappyCloud) (Version: 4.28 - Happy Cloud, Inc.)
Java 8 Update 121 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1702488835-1983202832-4074137989-1001\...\OneDriveSetup.exe) (Version: 17.3.6799.0327 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
NVIDIA Ovladač 3D Vision 342.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 342.01 - NVIDIA Corporation)
NVIDIA Ovladač řídící jednotky 3D Vision 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA Ovladače grafiky 342.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 342.01 - NVIDIA Corporation)
NVIDIA Systémový software PhysX 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
OpenOffice 4.1.3 (HKLM-x32\...\{7308600A-5231-459C-A3E2-A637F842CACA}) (Version: 4.13.9783 - Apache Software Foundation)
Opera Stable 34.0.2036.50 (HKLM-x32\...\Opera 34.0.2036.50) (Version: 34.0.2036.50 - Opera Software)
Opera Stable 44.0.2510.857 (HKLM-x32\...\Opera 44.0.2510.857) (Version: 44.0.2510.857 - Opera Software)
Origin (HKLM-x32\...\Origin) (Version: 10.4.3.15631 - Electronic Arts, Inc.)
Ovládací panel NVIDIA 342.01 (Version: 342.01 - NVIDIA Corporation) Hidden
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.2 - pdfforge)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7293 - Realtek Semiconductor Corp.)
Registrace uživatele zařízení Canon MG2900 series (HKLM-x32\...\Registrace uživatele zařízení Canon MG2900 series) (Version: - Canon Inc.)
SafeZone Stable 3.55.2393.596 (x32 Version: 3.55.2393.596 - Avast Software) Hidden
SHIELD Streaming (Version: 7.1.0280 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.11.4.0 - NVIDIA Corporation) Hidden
Skype™ 7.33 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.33.105 - Skype Technologies S.A.)
Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.6 - Sophos Limited)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.18 - TeamSpeak Systems GmbH)
UFO Aftermath (HKLM-x32\...\{3699BC50-DA7B-4DA7-BB43-2981C9178FAD}) (Version: 1.4 - )
Unity Web Player (HKU\S-1-5-21-1702488835-1983202832-4074137989-1001\...\UnityWebPlayer) (Version: 5.3.7f1 - Unity Technologies ApS)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
WinRAR 5.40 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
World of Tanks (HKU\S-1-5-21-1702488835-1983202832-4074137989-1001\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812eu}_is1) (Version: - Wargaming.net)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)
youndoo - Uninstall (HKLM-x32\...\{743EE930-C9C3-4FE0-83C0-95B2544F3C71}) (Version: - ) <==== ATTENTION
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0A6FE069-5CDF-4D9B-9C4F-E1914735F01C} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-11] (Adobe Systems Incorporated)
Task: {0B97D483-F3FF-47E9-A5DD-39F73D90B625} - System32\Tasks\{B0398A1E-36C7-43FB-9909-CFEF2DB23E1A} => pcalua.exe -a C:\Users\Golfstar\AppData\Local\Temp\Temp1_realtek_hd_audio.zip\Realtek_6.0.1.7293\Setup.exe <==== ATTENTION
Task: {21C2BF43-31B0-42DD-B520-C8F94F9CCFBC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-02-02] (Adobe Systems Incorporated)
Task: {21E0D8FE-3E38-4EFC-BBBD-78E37A315D93} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => %SystemRoot%\ehome\ehPrivJob.exe
Task: {22E3C4B9-CF31-4D7A-851F-740850291ABD} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {26637E59-CBD2-425C-98F5-ACB0EF26D2A2} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => %SystemRoot%\ehome\ehPrivJob.exe
Task: {2CD7CD30-B2A7-44AD-ACBC-CACED2F0A9FF} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => %SystemRoot%\ehome\mcupdate.exe
Task: {325C5FA8-56E6-4F38-8F0B-D0C08199727E} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {3350CA44-F2DB-4495-9FF3-DBAD35A84FC5} - System32\Tasks\Ranient Host => C:\Program Files (x86)\Votyphalury\xrerqty.exe
Task: {351E4305-5CAF-4135-B01F-D8A81E0C30C4} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_25_0_0_148_pepper.exe [2017-04-11] (Adobe Systems Incorporated)
Task: {35ADB62C-5AE3-4686-8C74-A75455923BA7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {3C290BF5-B1CF-4247-BD5A-08704D45A18C} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => %SystemRoot%\ehome\ehrec.exe
Task: {3EB4F7C0-D470-42AC-9F69-F75EB8924910} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1003Core => C:\Users\Bíba\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-09-22] (Facebook Inc.)
Task: {446A4685-4EF6-43E0-BCC8-1C265023A7DA} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => %SystemRoot%\ehome\ehPrivJob.exe
Task: {49F13AD9-E445-4192-9689-D6BCBA4B827F} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {5534D8DC-73FD-4290-B4BB-EAAD8B1B69EE} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {590136F4-1338-441C-90CC-EE8CC9080098} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
Task: {5FD9F7D4-A622-48CB-9F0D-AB935077E1B4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {6244A5ED-BF59-461D-9803-A8B9D5E447A4} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => %SystemRoot%\ehome\ehPrivJob.exe
Task: {645C87A4-F131-494C-9765-880D5899E9F5} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-04-13] (AVAST Software)
Task: {64607E21-419A-4421-903B-A8C867C6C856} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {7054D474-3647-4FB4-8E98-BB6FF4F539AA} - System32\Tasks\SafeZone scheduled Autoupdate 1458712455 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2017-03-22] (Avast Software)
Task: {721363B0-D0E1-4411-99CC-48730BD18A95} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {74BD4118-8CB5-41BE-B8A0-3EBB5C4027D7} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1001Core => C:\Users\Golfstar\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-18] (Dropbox, Inc.)
Task: {7760CE39-1015-470E-8C8A-AD987D7A803D} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {788D79D3-4858-4C4C-B77D-76CAC4C65228} - System32\Tasks\{003EDB46-6616-4516-9878-8D6C1A36F450} => pcalua.exe -a F:\SCHMIDT\SpielefürKids\SpielefürKids.exe -d F:\SCHMIDT\SpielefürKids
Task: {7A237F8B-5BD8-4A0C-871C-6A75DFFEC5CE} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => %SystemRoot%\ehome\ehPrivJob.exe
Task: {7AB30839-C362-48AA-B746-08DE0D5AAB55} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => %SystemRoot%\ehome\ehPrivJob.exe
Task: {81EB9F5C-B447-49F9-88DE-B24281D8CC28} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => %SystemRoot%\ehome\ehrec.exe
Task: {86CEE7C3-ABA2-4C1F-BFC3-79E36ECB52A0} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-04-04] (AVAST Software)
Task: {880A33C5-7226-4395-9D58-FAE99A8988F4} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {8F9EA8C8-9746-40A0-A3A6-3AE2E6C9CC20} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {91E9D3D5-A53E-442F-850A-E64717B9CCC5} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => %SystemRoot%\ehome\mcupdate.exe
Task: {92E24798-09B3-45C3-8AFE-902F2E509CF8} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {9C5D9140-0490-4ED6-A447-B1FCBD9312A9} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {9C7D3BB6-7582-4D77-AEE4-C9144D1204A0} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => %SystemRoot%\ehome\ehPrivJob.exe
Task: {9CD37173-D474-4555-B53F-56EA145611A5} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => %SystemRoot%\ehome\ehPrivJob.exe
Task: {9E0D51EC-E685-4A22-8110-706C4BAD02A2} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => %SystemRoot%\ehome\ehPrivJob.exe
Task: {9F660A57-81D9-4D2C-84D4-8BD8D268535A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1003UA => C:\Users\Bíba\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-09-22] (Facebook Inc.)
Task: {A12164E5-1E40-4DD3-94BA-8E42211AFF1C} - System32\Tasks\Opera scheduled Autoupdate 1423217291 => C:\Program Files (x86)\Opera\launcher.exe [2017-03-21] (Opera Software)
Task: {A40E63B7-966A-4F40-9256-AC406E91BE31} - System32\Tasks\AdobeAAMUpdater-1.0-Golfstar1-Golfstar => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {B1D3E821-3952-4F44-BFBC-BBE02D001D8C} - System32\Tasks\AdobeAAMUpdater-1.0-Golfstar1-Bíba => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {B3B71E96-A33F-440B-8FA1-3865900981C0} - \Microsoft\Windows\Setup\EOONotify -> No File <==== ATTENTION
Task: {B767CCB0-721D-4365-936A-F57044B527E2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {BE1C3502-DB2A-47FC-B6F3-485E251E3D85} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => %SystemRoot%\ehome\mcupdate.exe
Task: {C4618E97-A197-4099-BC36-3FDC0B8D67D7} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION
Task: {C735C0BA-ABCF-42EB-AE2A-64D8ADB52211} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => %SystemRoot%\ehome\ehPrivJob.exe
Task: {CA9B6304-F9D0-4CD8-8795-195BA6B71B45} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {CBE3C887-0234-4EA7-AE9A-7E22F9F2983C} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => %SystemRoot%\ehome\ehPrivJob.exe
Task: {D192F2CE-6C2E-4245-82F9-D9441F56E6C2} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => %SystemRoot%\ehome\ehPrivJob.exe
Task: {D6C53E4D-4A1F-462B-A9CB-AFCF96F419AF} - System32\Tasks\avastBCLRestartS-1-5-21-1702488835-1983202832-4074137989-1001 => Firefox.exe
Task: {DE4A91E6-8380-4AE9-AC5F-4775F3D9E5BC} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => %SystemRoot%\ehome\ehPrivJob.exe
Task: {E2998301-C997-4304-B296-85E760F01E10} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe
Task: {E53F24DE-2A42-4748-ABBA-57E33C47012B} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {E897ACDC-72BD-41F7-84F6-BED04469039F} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {E8C19607-E8B5-4DE9-8B23-C08E2AA0B1E7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {ED764F08-434F-47C8-9F3C-5F6929DA7934} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1001UA => C:\Users\Golfstar\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-18] (Dropbox, Inc.)
Task: {F2045078-5CC5-44FE-A7CD-83F549CCCAC5} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => %windir%\ehome\MCUpdate.exe
Task: {F40FA315-4B44-48B8-A511-34E818B16087} - \CCleanerSkipUAC -> No File <==== ATTENTION
Task: {FFB1792F-ACDA-43C2-946E-4E09461FF000} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1001Core.job => C:\Users\Golfstar\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1001UA.job => C:\Users\Golfstar\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1003Core.job => C:\Users\Bíba\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1003UA.job => C:\Users\Bíba\AppData\Local\Facebook\Update\FacebookUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
Shortcut: C:\Users\Golfstar\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Ballduck\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Golfstar\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Ballduck\Application\chrome.exe (Google Inc.)
==================== Loaded Modules (Whitelisted) ==============
2017-03-15 08:39 - 2017-03-04 07:31 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-11-12 00:54 - 2013-06-28 16:28 - 00084616 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2016-09-04 22:40 - 2016-06-14 22:03 - 00367552 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\MessageBus.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 00288192 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamBase.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 01147328 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\libprotobuf.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 03611584 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Poco.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 02665920 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvMdnsPlugin.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 01988544 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvPortForwardPlugin.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 01840576 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\RtspPlugin.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 00207296 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\RtspServer.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 00034240 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_system-vc120-mt-1_58.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 00920000 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_regex-vc120-mt-1_58.dll
2017-04-11 20:25 - 2017-03-28 12:17 - 02656952 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2017-04-11 20:25 - 2017-03-28 12:17 - 02656952 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2017-03-15 08:39 - 2017-03-04 05:19 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-03-15 08:39 - 2017-03-04 05:14 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-04-11 20:25 - 2017-03-28 07:01 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-04-11 20:25 - 2017-03-28 07:04 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-04-27 08:15 - 2016-04-27 08:15 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-07-23 10:42 - 2016-07-23 10:42 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-07-23 10:03 - 2016-11-14 13:15 - 00135224 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-09-21 20:20 - 2017-02-19 10:22 - 02493440 _____ () C:\Program Files (x86)\Origin\libGLESv2.dll
2017-04-04 19:20 - 2017-04-04 19:20 - 00170216 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-09-26 19:23 - 2016-09-26 19:23 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-04-04 19:20 - 2017-04-04 19:20 - 00176480 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll
2017-04-04 19:20 - 2017-04-04 19:20 - 00293936 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2017-04-04 19:20 - 2017-04-04 19:20 - 00653520 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2017-03-17 20:22 - 2017-02-01 11:01 - 01870168 _____ () C:\Program Files (x86)\Ballduck\Application\libglesv2.dll
2017-03-17 20:22 - 2017-02-01 11:01 - 00085848 _____ () C:\Program Files (x86)\Ballduck\Application\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Golfstar\Desktop\Fotograf_oponentura_Neználek Rob.doc:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Golfstar\Desktop\Historik_po oponenturách 2-Rob.doc:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Golfstar\Desktop\Odborka_Ježíšův učedník-definitiva.doc:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Golfstar\Desktop\Odborka_Poutník_za_ pravdou-definitiva.doc:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Golfstar\Desktop\Odborka_Znalec_krestan-tradic a bohosluzby-definitiva.doc:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Golfstar\Desktop\Plavec-připomínky-Smurf Rob.doc:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Golfstar\Desktop\Skautský historik_po oponentuře 2 Rob.doc:com.dropbox.attributes [168]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2016-09-04 23:50 - 2016-09-04 23:51 - 00001305 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1702488835-1983202832-4074137989-1001\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg
DNS Servers: 10.0.0.138
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HandyAndy.lnk => C:\Windows\pss\HandyAndy.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Golfstar^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\Golfstar\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: BlueStacks Agent => C:\Program Files (x86)\BlueStacks\HD-Agent.exe
MSCONFIG\startupreg: Dropbox Update => "C:\Users\Golfstar\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{5F40314D-7EA2-40E2-B3A9-D06851200A1D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8DD743E3-8F24-4E16-80EB-C3D942192C56}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{95C4440B-BED8-413C-9A87-0E9062838982}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{879E121C-F5B0-4497-A72C-AC50C4D1E0C2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{EC441F0B-8E7B-4A91-9441-8AB2B1475C12}] => (Allow) C:\Program Files\Andy\SetupFiles\VMwareCheck.exe
FirewallRules: [{F81C4976-F08A-4499-AAE7-005DB2494C0B}] => (Allow) C:\Program Files\Andy\SetupFiles\VMwareCheck.exe
FirewallRules: [{97B8823E-7902-45F7-A06E-FC13F752600B}] => (Allow) C:\Program Files\Andy\SetupFiles\Uninstall.exe
FirewallRules: [{6AFC7242-E8DC-4D81-B1E4-55E466BAB76F}] => (Allow) C:\Program Files\Andy\SetupFiles\Uninstall.exe
FirewallRules: [{148502C5-7BD8-460E-BF01-C92FBED0CD5F}] => (Allow) C:\Program Files\Andy\HandyAndy.exe
FirewallRules: [{09624E5E-1598-4332-B908-B7C26146B6DA}] => (Allow) C:\Program Files\Andy\HandyAndy.exe
FirewallRules: [{1091B4A5-7A93-471E-A531-14DC3646477B}] => (Allow) C:\Program Files\Andy\AndyConsole.exe
FirewallRules: [{10B05572-80A5-4E5A-B5A2-FE8C638BDF3B}] => (Allow) C:\Program Files\Andy\AndyConsole.exe
FirewallRules: [{074C047D-FC44-466B-8B56-C4CB0E23EF31}] => (Allow) C:\Program Files\Andy\andy.exe
FirewallRules: [{83366DAE-DD50-44BF-BDA7-05462ACD0740}] => (Allow) C:\Program Files\Andy\andy.exe
FirewallRules: [{FD22A214-7007-444D-AF46-1006B17EEEA5}] => (Allow) C:\Users\Golfstar\AppData\Local\Temp\andy-x64\Setup.exe
FirewallRules: [{1BD5A653-5DE7-4138-96B8-752DD744FC45}] => (Allow) C:\Users\Golfstar\AppData\Local\Temp\andy-x64\Setup.exe
FirewallRules: [{88566DB5-CB15-4113-9F8D-1B836527F969}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{CC61022C-F455-4A49-8BC0-63435A27C53F}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{17658538-7306-4856-AA3D-E8786B005C70}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{D87C97A7-8587-4F47-8D75-58A0654A12DC}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{A6406223-90A2-49D6-BACC-5AF2BA668F3B}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{A446DAFA-0C04-44F0-B9D7-54F216F8BA8E}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{4BCBEEF8-4379-4731-96C0-8761BC795229}] => (Allow) C:\Games\World_of_Tanks\worldoftanks.exe
FirewallRules: [{D65D6BBC-CA7C-468B-8E43-1515908E5714}] => (Allow) C:\Games\World_of_Tanks\worldoftanks.exe
FirewallRules: [{D0C2102F-47FC-4D3F-892A-1679665716FD}] => (Allow) C:\Games\World_of_Tanks\WoTLauncher.exe
FirewallRules: [{CF1CE978-2BD8-4D28-B35E-524FACB115A7}] => (Allow) C:\Games\World_of_Tanks\WoTLauncher.exe
FirewallRules: [{9C5301F0-14E1-4A9C-AEFD-58A8D4F1FEED}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{1F2CD24F-EB93-420B-9E48-C73095C0B4E0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [UDP Query User{9BD45D29-C7E5-4EAF-89BD-DD09B279C14C}C:\program files (x86)\ccp\eve\bin\exefile.exe] => (Block) C:\program files (x86)\ccp\eve\bin\exefile.exe
FirewallRules: [TCP Query User{DAF6837D-9B69-4F34-BFB3-FF3238808320}C:\program files (x86)\ccp\eve\bin\exefile.exe] => (Block) C:\program files (x86)\ccp\eve\bin\exefile.exe
FirewallRules: [{D5580A2E-9275-4441-AE33-E7B5A44A73B5}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{88D825FB-61E0-4C0C-B4B0-14D6099F9B59}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{0BB3DD57-BEA7-409D-9207-F9CE4806C61F}] => (Allow) C:\Program Files (x86)\GameforgeLive\Games\GBR_eng\S.K.I.L.L\Binaries\Win32\sf2.exe
FirewallRules: [{94A400EF-77F5-4EB1-9BF5-125EB64B4460}] => (Allow) C:\Program Files (x86)\GameforgeLive\Games\GBR_eng\S.K.I.L.L\Binaries\Win32\sf2.exe
FirewallRules: [{4CC3E25E-4D64-4746-A65A-CC63646081A3}] => (Allow) C:\Program Files (x86)\GameforgeLive\gfl_client.exe
FirewallRules: [UDP Query User{8EEABDE4-8AE9-4A61-A121-1EBA5B7CD466}C:\users\golfstar\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\golfstar\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{77428CDA-1B5D-48BB-977E-6E2406BD7042}C:\users\golfstar\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\golfstar\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{1408C129-BF8E-472B-A935-B993C5570F9F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3C5CB880-B2B6-4BF2-AAB2-A844EE96C40B}] => (Allow) C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{6D11B4DE-51DB-4E1A-BB63-A7EAA50BFB3C}] => (Allow) C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{8B805305-EE58-4A7A-A21D-5B2E8E69D006}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{91204E13-A122-42CB-865A-7716B615ACD5}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivlauncher.exe
FirewallRules: [{D8A94AC4-0374-46C2-B469-8F03BBF6B53E}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivlauncher.exe
FirewallRules: [{3C5829D9-3E81-4E27-B55B-EE83A40E9443}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivboot.exe
FirewallRules: [{BFA072F4-30B2-452B-AE75-FE4AEF4911CB}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivboot.exe
FirewallRules: [{821060F5-9E41-435F-8259-0481B0E9CB1A}] => (Allow) C:\ProgramData\Turbine\The Lord of the Rings Online\TurbineLauncher.exe
FirewallRules: [{32DAE3F3-AAE2-4CAD-B228-FB84BACB3053}] => (Allow) C:\ProgramData\Turbine\The Lord of the Rings Online\TurbineLauncher.exe
FirewallRules: [{C99281C3-B306-4F89-B141-370FDC975970}] => (Allow) C:\ProgramData\Turbine\The Lord of the Rings Online\lotroclient.exe
FirewallRules: [{F17FEA22-420F-4BB8-8606-BF643899EED2}] => (Allow) C:\ProgramData\Turbine\The Lord of the Rings Online\lotroclient.exe
FirewallRules: [{80EA73E5-5E84-4430-AB51-2EF40B9B75B6}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 1 Open Beta\bf1.exe
FirewallRules: [{F9A313C9-E9BB-4F16-A983-BECFB4E3685C}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 1 Open Beta\bf1.exe
FirewallRules: [{AB3265CB-46BF-47FB-9411-3F6834FAFF5D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{C45C517B-E064-43EC-81CD-5D192391E0A3}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{0698AEB3-8857-4FA2-8D1B-009BAA1A2C92}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{7B08F3F5-7158-46FA-A0C0-FBAB85A324C1}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{5924DDB8-55AA-4100-A1A5-36B323FB541E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{4648FBD4-370B-4A36-B0E2-5BF9510D6C44}] => (Allow) C:\Hry\WarThunder\run.exe
FirewallRules: [{B2B3DC6F-33FD-4497-8A3A-FCB4D6D6D543}] => (Allow) C:\Hry\WarThunder\run.exe
FirewallRules: [{0C3C6FD3-793D-4ECD-90AB-2E181526EB0B}] => (Allow) LPort=80
FirewallRules: [{32E95327-A1F9-40CA-A5CB-BE755386E5B0}] => (Allow) LPort=443
FirewallRules: [{48EC70E6-BF81-4570-948B-E35E6D924386}] => (Allow) LPort=20010
FirewallRules: [{AC62C566-A783-45A4-80D9-57F3BC0001FC}] => (Allow) LPort=3478
FirewallRules: [{F17944BD-8336-4250-AB2F-9FAC54F58CDB}] => (Allow) LPort=7850
FirewallRules: [{8300C4B9-8EC2-43DE-A760-B85A85C8F03C}] => (Allow) LPort=7852
FirewallRules: [{BAE68FCA-C985-487A-ABC8-022AB0EABCD5}] => (Allow) LPort=7853
FirewallRules: [{3FD84B3C-92FA-459D-B9B2-F9D1D4F42541}] => (Allow) LPort=27022
FirewallRules: [{4CE2B0F9-82DA-483C-B6DA-A9E2074F6C69}] => (Allow) LPort=6881
FirewallRules: [{F6B0AE0B-22E4-4B3D-82E1-AD470A0D3EA2}] => (Allow) LPort=33333
FirewallRules: [{113407A7-43A5-4544-9443-D27AE39BCFE3}] => (Allow) LPort=20443
FirewallRules: [{97374C6D-2B12-40C5-962E-F3067A8804B9}] => (Allow) LPort=8090
FirewallRules: [TCP Query User{34AC58FC-F38D-4E0F-8671-946D6111DA62}C:\hry\warthunder\win64\aces.exe] => (Block) C:\hry\warthunder\win64\aces.exe
FirewallRules: [UDP Query User{FCC0F02D-5017-49B3-8EFF-36F00C089953}C:\hry\warthunder\win64\aces.exe] => (Block) C:\hry\warthunder\win64\aces.exe
FirewallRules: [{09E5C13B-C2A3-4A15-B21C-1AAF9F5A1931}] => (Allow) C:\Program Files (x86)\Opera\43.0.2442.1144\opera.exe
FirewallRules: [{B1AC82C5-2BA4-4D7B-82AB-7862FFAB2EC6}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.590\SZBrowser.exe
FirewallRules: [{B4057743-F6B8-4DDB-9128-6C0511197398}] => (Allow) C:\Program Files (x86)\Ballduck\Application\chrome.exe
FirewallRules: [{4D1F44E0-AE2A-4EF2-B238-352B4F161776}] => (Allow) C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe
FirewallRules: [{20FE4D0D-3C8F-469B-91C3-A4049A72BB86}] => (Allow) C:\Program Files (x86)\Firefox\Firefox.exe
FirewallRules: [{272BF586-ACC4-479E-9B33-584AA0E96F3E}] => (Allow) C:\Program Files (x86)\Opera\44.0.2510.857\opera.exe
FirewallRules: [{280CCEF0-8DCC-4B07-97A8-077084540CD3}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.596\SZBrowser.exe
FirewallRules: [{FACF7159-EF9E-466C-B166-DDC4DEEE4B65}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{22C6373D-779A-4F87-B1F3-95D620336247}] => (Allow) C:\Program Files (x86)\MIO\loader\wdcxwd10eads-00m2b0_wd-wcav5494550345503.dat
FirewallRules: [{A0777183-AEAA-4324-BE10-072054CBB63B}] => (Allow) C:\Program Files (x86)\MIO\loader\wdcxwd10eads-00m2b0_wd-wcav5494550345503.dat
==================== Restore Points =========================
06-04-2017 08:13:02 Naplánovaný kontrolní bod
11-04-2017 20:56:42 Windows Update
12-04-2017 19:02:09 JRT Pre-Junkware Removal
13-04-2017 23:26:08 JRT Pre-Junkware Removal
15-04-2017 00:17:53 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/15/2017 12:18:17 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Protokol Microsoft LLDP (Link-Layer Discovery Protocol).
System Error:
Přístup byl odepřen.
.
Error: (04/15/2017 12:17:53 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Chyba služby Stínová kopie svazků: Při volání rutiny ConvertStringSidToSid(S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415.bak) došlo k neočekávané chybě. hr= 0x80070539, Struktura ID zabezpečení není platná.
.
Operace:
Událost OnIdentify
Shromažďování dat modulu pro zápis
Kontext:
Kontext spuštění: Shadow Copy Optimization Writer
ID třídy modulu pro zápis: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Název modulu pro zápis: Shadow Copy Optimization Writer
ID instance modulu pro zápis: {90353b78-bb96-46c1-8c70-0c891655d545}
Error: (04/14/2017 11:50:51 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Program UFO.exe verze 0.0.0.0 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Zabezpečení a údržba.
ID procesu: 12bc
Čas spuštění: 01d2b5659da9b36f
Čas ukončení: 4294967295
Cesta k aplikaci: C:\Program Files (x86)\CENEGA\UFO Aftermath\UFO.exe
ID hlášení: 6c3bfa49-215c-11e7-802d-002421e462e3
Úplný název balíčku s chybou:
ID aplikace související s balíčkem s chybou:
Error: (04/14/2017 11:25:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Program UFO.exe verze 0.0.0.0 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Zabezpečení a údržba.
ID procesu: d08
Čas spuštění: 01d2b5655ecb698f
Čas ukončení: 35
Cesta k aplikaci: C:\Program Files (x86)\CENEGA\UFO Aftermath\UFO.exe
ID hlášení: d5e74da1-2158-11e7-802d-002421e462e3
Úplný název balíčku s chybou:
ID aplikace související s balíčkem s chybou:
Error: (04/14/2017 11:23:26 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Program UFO.exe verze 0.0.0.0 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Zabezpečení a údržba.
ID procesu: 1600
Čas spuštění: 01d2b5653070a479
Čas ukončení: 39
Cesta k aplikaci: C:\Program Files (x86)\CENEGA\UFO Aftermath\UFO.exe
ID hlášení: 94c29c22-2158-11e7-802d-002421e462e3
Úplný název balíčku s chybou:
ID aplikace související s balíčkem s chybou:
Error: (04/14/2017 11:22:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Program UFO.exe verze 0.0.0.0 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Zabezpečení a údržba.
ID procesu: 1008
Čas spuštění: 01d2b564bd5f8a03
Čas ukončení: 37
Cesta k aplikaci: C:\Program Files (x86)\CENEGA\UFO Aftermath\UFO.exe
ID hlášení: 64b55e6b-2158-11e7-802d-002421e462e3
Úplný název balíčku s chybou:
ID aplikace související s balíčkem s chybou:
Error: (04/14/2017 09:48:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: NvStreamUserAgent.exe, verze: 7.1.2084.9592, časové razítko: 0x57605c64
Název chybujícího modulu: ntdll.dll, verze: 10.0.10586.672, časové razítko: 0x580ee321
Kód výjimky: 0xc0000005
Posun chyby: 0x000000000002e909
ID chybujícího procesu: 0x118c
Čas spuštění chybující aplikace: 0x01d2b5581fa80d7a
Cesta k chybující aplikaci: C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
Cesta k chybujícímu modulu: C:\WINDOWS\SYSTEM32\ntdll.dll
ID zprávy: 7408813a-a58b-481a-acdd-bd185b8585af
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:
Error: (04/14/2017 09:32:42 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Generování kontextu aktivace pro C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKCmdDefrag.dll se nezdařilo.
Závislé sestavení Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.
Error: (04/14/2017 09:32:42 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Generování kontextu aktivace pro C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKCmdFS.dll se nezdařilo.
Závislé sestavení Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.
Error: (04/14/2017 09:32:41 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Generování kontextu aktivace pro C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKEngine.dll se nezdařilo.
Závislé sestavení Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.
System errors:
=============
Error: (04/15/2017 12:18:49 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba NVIDIA Display Driver Service byla neočekávaně ukončena. Tento stav nastal již 1krát.
Error: (04/15/2017 12:13:21 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Služba NetTcpActivator závisí na službě NetTcpPortSharing, která neuspěla při spuštění v důsledku následující chyby:
Zvolenou službu nelze spustit, protože není povolena nebo s ní není spojeno žádné povolené zařízení.
Error: (04/15/2017 12:13:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Služba VMnetBridge neuspěla při spuštění v důsledku následující chyby:
Systém nemůže nalézt uvedený soubor.
Error: (04/15/2017 12:11:57 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Hostitel synchronizace_83c843 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restartovat službu.
Error: (04/15/2017 12:11:44 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba Disc Soft Lite Bus Service byla neočekávaně ukončena. Tento stav nastal již 1krát.
Error: (04/15/2017 12:11:44 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Windows Search byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 30000 milisekund: Restartovat službu.
Error: (04/15/2017 12:11:44 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba NVIDIA Streamer Network Service byla neočekávaně ukončena. Tento stav nastal již 1krát.
Error: (04/15/2017 12:11:44 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba Origin Web Helper Service byla neočekávaně ukončena. Tento stav nastal již 1krát.
Error: (04/15/2017 12:11:44 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba NVIDIA Streamer Service byla neočekávaně ukončena. Tento stav nastal již 1krát.
Error: (04/15/2017 12:11:44 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Řízení front zpráv byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 120000 milisekund: Restartovat službu.
CodeIntegrity:
===================================
Date: 2017-04-11 21:51:44.595
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-04-06 23:37:06.530
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\msiexec.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Sophos\Sophos Virus Removal Tool\SVRTcli.exe that did not meet the Microsoft signing level requirements.
Date: 2017-03-30 06:56:32.071
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-03-19 18:08:42.263
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-03-18 07:06:09.150
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2017-03-18 06:23:12.774
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2017-03-18 06:23:12.643
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2017-03-18 00:37:36.324
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2017-03-17 22:18:33.505
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2017-03-17 22:16:10.706
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5 CPU 750 @ 2.67GHz
Percentage of memory in use: 24%
Total physical RAM: 8183.11 MB
Available physical RAM: 6214.96 MB
Total Virtual: 16375.11 MB
Available Virtual: 14384.06 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:931.41 GB) (Free:642.67 GB) NTFS
Drive d: (Rezervováno systémem) (Fixed) (Total:0.1 GB) (Free:0.01 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive e: (KRD10) (CDROM) (Total:0.29 GB) (Free:0 GB) CDFS
Drive f: (Zaloha) (Fixed) (Total:111.8 GB) (Free:11.2 GB) NTFS
Drive g: (201007251918) (CDROM) (Total:1.13 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 7A0FD819)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 111.8 GB) (Disk ID: 1D551D54)
Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
před nedávnem se mi dostal nějakým způsobem do PC prográmek Kyubey.exe .
Dle Vašeho fóra jsem jej po několika pokusech dokázal odstranit. Přesto není vše v pořádku - v prohlížeči se přepisuje startovací stránka, manuálně nejde změnit nastavení prohlížeče, z reportu Hijackthis se mi nezdají určité údaje co by tam neměli být.
Dle návodu zasílám log FRST
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017
Ran by Golfstar (15-04-2017 00:38:49)
Running from C:\Users\Golfstar\Desktop
Windows 10 Pro Version 1511 (X64) (2016-07-23 11:10:22)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1702488835-1983202832-4074137989-500 - Administrator - Disabled)
Bíba (S-1-5-21-1702488835-1983202832-4074137989-1003 - Limited - Enabled) => C:\Users\Bíba
DefaultAccount (S-1-5-21-1702488835-1983202832-4074137989-503 - Limited - Disabled)
Golfstar (S-1-5-21-1702488835-1983202832-4074137989-1001 - Administrator - Enabled) => C:\Users\Golfstar
Guest (S-1-5-21-1702488835-1983202832-4074137989-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1702488835-1983202832-4074137989-1002 - Limited - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avast Antivirus (Disabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Disabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 16.04 (HKLM-x32\...\{23170F69-40C1-2701-1604-000001000000}) (Version: 16.04.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Czech (HKLM-x32\...\{AC76BA86-7AD7-1029-7B44-AC0F074E4100}) (Version: 17.009.20044 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 25.0.0.134 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.148 - Adobe Systems Incorporated)
Adobe Flash Player 25 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 25.0.0.148 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Photoshop CS5 (HKLM-x32\...\{15FEDA5F-141C-4127-8D7E-B962D1742728}) (Version: 12.0 - Adobe Systems Incorporated)
Aktualizace NVIDIA 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
Avast Free Antivirus (HKLM-x32\...\Avast Antivirus) (Version: 17.3.2291 - AVAST Software)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BitRaider Streaming Client (HKLM-x32\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.7.0.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.1.10.15 - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: 4.2.0 - Canon Inc.)
Canon MG2900 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2900_series) (Version: 1.01 - Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 3.5.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 3.5.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.3.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.7.1 - Canon Inc.)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.5.1.0230 - Disc Soft Ltd)
Dropbox (HKU\S-1-5-21-1702488835-1983202832-4074137989-1001\...\Dropbox) (Version: 6.4.14 - Dropbox, Inc.)
EVE Online (HKLM-x32\...\{345CEED5-9EAD-41BE-A90F-F3F4B85BABAF}) (Version: 3.0.0 - CCP Games Ltd.)
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Gameforge Live 2.0.6 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.6 - Gameforge)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.33.3 - Google Inc.) Hidden
Happy Cloud Client (HKU\S-1-5-21-1702488835-1983202832-4074137989-1001\...\HappyCloud) (Version: 4.28 - Happy Cloud, Inc.)
Java 8 Update 121 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1702488835-1983202832-4074137989-1001\...\OneDriveSetup.exe) (Version: 17.3.6799.0327 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
NVIDIA Ovladač 3D Vision 342.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 342.01 - NVIDIA Corporation)
NVIDIA Ovladač řídící jednotky 3D Vision 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA Ovladače grafiky 342.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 342.01 - NVIDIA Corporation)
NVIDIA Systémový software PhysX 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
OpenOffice 4.1.3 (HKLM-x32\...\{7308600A-5231-459C-A3E2-A637F842CACA}) (Version: 4.13.9783 - Apache Software Foundation)
Opera Stable 34.0.2036.50 (HKLM-x32\...\Opera 34.0.2036.50) (Version: 34.0.2036.50 - Opera Software)
Opera Stable 44.0.2510.857 (HKLM-x32\...\Opera 44.0.2510.857) (Version: 44.0.2510.857 - Opera Software)
Origin (HKLM-x32\...\Origin) (Version: 10.4.3.15631 - Electronic Arts, Inc.)
Ovládací panel NVIDIA 342.01 (Version: 342.01 - NVIDIA Corporation) Hidden
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.2 - pdfforge)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7293 - Realtek Semiconductor Corp.)
Registrace uživatele zařízení Canon MG2900 series (HKLM-x32\...\Registrace uživatele zařízení Canon MG2900 series) (Version: - Canon Inc.)
SafeZone Stable 3.55.2393.596 (x32 Version: 3.55.2393.596 - Avast Software) Hidden
SHIELD Streaming (Version: 7.1.0280 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.11.4.0 - NVIDIA Corporation) Hidden
Skype™ 7.33 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.33.105 - Skype Technologies S.A.)
Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.6 - Sophos Limited)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.18 - TeamSpeak Systems GmbH)
UFO Aftermath (HKLM-x32\...\{3699BC50-DA7B-4DA7-BB43-2981C9178FAD}) (Version: 1.4 - )
Unity Web Player (HKU\S-1-5-21-1702488835-1983202832-4074137989-1001\...\UnityWebPlayer) (Version: 5.3.7f1 - Unity Technologies ApS)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
WinRAR 5.40 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
World of Tanks (HKU\S-1-5-21-1702488835-1983202832-4074137989-1001\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812eu}_is1) (Version: - Wargaming.net)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)
youndoo - Uninstall (HKLM-x32\...\{743EE930-C9C3-4FE0-83C0-95B2544F3C71}) (Version: - ) <==== ATTENTION
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1702488835-1983202832-4074137989-1001_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0A6FE069-5CDF-4D9B-9C4F-E1914735F01C} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-11] (Adobe Systems Incorporated)
Task: {0B97D483-F3FF-47E9-A5DD-39F73D90B625} - System32\Tasks\{B0398A1E-36C7-43FB-9909-CFEF2DB23E1A} => pcalua.exe -a C:\Users\Golfstar\AppData\Local\Temp\Temp1_realtek_hd_audio.zip\Realtek_6.0.1.7293\Setup.exe <==== ATTENTION
Task: {21C2BF43-31B0-42DD-B520-C8F94F9CCFBC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-02-02] (Adobe Systems Incorporated)
Task: {21E0D8FE-3E38-4EFC-BBBD-78E37A315D93} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => %SystemRoot%\ehome\ehPrivJob.exe
Task: {22E3C4B9-CF31-4D7A-851F-740850291ABD} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {26637E59-CBD2-425C-98F5-ACB0EF26D2A2} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => %SystemRoot%\ehome\ehPrivJob.exe
Task: {2CD7CD30-B2A7-44AD-ACBC-CACED2F0A9FF} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => %SystemRoot%\ehome\mcupdate.exe
Task: {325C5FA8-56E6-4F38-8F0B-D0C08199727E} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {3350CA44-F2DB-4495-9FF3-DBAD35A84FC5} - System32\Tasks\Ranient Host => C:\Program Files (x86)\Votyphalury\xrerqty.exe
Task: {351E4305-5CAF-4135-B01F-D8A81E0C30C4} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_25_0_0_148_pepper.exe [2017-04-11] (Adobe Systems Incorporated)
Task: {35ADB62C-5AE3-4686-8C74-A75455923BA7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {3C290BF5-B1CF-4247-BD5A-08704D45A18C} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => %SystemRoot%\ehome\ehrec.exe
Task: {3EB4F7C0-D470-42AC-9F69-F75EB8924910} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1003Core => C:\Users\Bíba\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-09-22] (Facebook Inc.)
Task: {446A4685-4EF6-43E0-BCC8-1C265023A7DA} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => %SystemRoot%\ehome\ehPrivJob.exe
Task: {49F13AD9-E445-4192-9689-D6BCBA4B827F} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {5534D8DC-73FD-4290-B4BB-EAAD8B1B69EE} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {590136F4-1338-441C-90CC-EE8CC9080098} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
Task: {5FD9F7D4-A622-48CB-9F0D-AB935077E1B4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {6244A5ED-BF59-461D-9803-A8B9D5E447A4} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => %SystemRoot%\ehome\ehPrivJob.exe
Task: {645C87A4-F131-494C-9765-880D5899E9F5} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-04-13] (AVAST Software)
Task: {64607E21-419A-4421-903B-A8C867C6C856} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {7054D474-3647-4FB4-8E98-BB6FF4F539AA} - System32\Tasks\SafeZone scheduled Autoupdate 1458712455 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2017-03-22] (Avast Software)
Task: {721363B0-D0E1-4411-99CC-48730BD18A95} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {74BD4118-8CB5-41BE-B8A0-3EBB5C4027D7} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1001Core => C:\Users\Golfstar\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-18] (Dropbox, Inc.)
Task: {7760CE39-1015-470E-8C8A-AD987D7A803D} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {788D79D3-4858-4C4C-B77D-76CAC4C65228} - System32\Tasks\{003EDB46-6616-4516-9878-8D6C1A36F450} => pcalua.exe -a F:\SCHMIDT\SpielefürKids\SpielefürKids.exe -d F:\SCHMIDT\SpielefürKids
Task: {7A237F8B-5BD8-4A0C-871C-6A75DFFEC5CE} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => %SystemRoot%\ehome\ehPrivJob.exe
Task: {7AB30839-C362-48AA-B746-08DE0D5AAB55} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => %SystemRoot%\ehome\ehPrivJob.exe
Task: {81EB9F5C-B447-49F9-88DE-B24281D8CC28} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => %SystemRoot%\ehome\ehrec.exe
Task: {86CEE7C3-ABA2-4C1F-BFC3-79E36ECB52A0} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-04-04] (AVAST Software)
Task: {880A33C5-7226-4395-9D58-FAE99A8988F4} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {8F9EA8C8-9746-40A0-A3A6-3AE2E6C9CC20} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {91E9D3D5-A53E-442F-850A-E64717B9CCC5} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => %SystemRoot%\ehome\mcupdate.exe
Task: {92E24798-09B3-45C3-8AFE-902F2E509CF8} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {9C5D9140-0490-4ED6-A447-B1FCBD9312A9} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {9C7D3BB6-7582-4D77-AEE4-C9144D1204A0} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => %SystemRoot%\ehome\ehPrivJob.exe
Task: {9CD37173-D474-4555-B53F-56EA145611A5} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => %SystemRoot%\ehome\ehPrivJob.exe
Task: {9E0D51EC-E685-4A22-8110-706C4BAD02A2} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => %SystemRoot%\ehome\ehPrivJob.exe
Task: {9F660A57-81D9-4D2C-84D4-8BD8D268535A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1003UA => C:\Users\Bíba\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-09-22] (Facebook Inc.)
Task: {A12164E5-1E40-4DD3-94BA-8E42211AFF1C} - System32\Tasks\Opera scheduled Autoupdate 1423217291 => C:\Program Files (x86)\Opera\launcher.exe [2017-03-21] (Opera Software)
Task: {A40E63B7-966A-4F40-9256-AC406E91BE31} - System32\Tasks\AdobeAAMUpdater-1.0-Golfstar1-Golfstar => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {B1D3E821-3952-4F44-BFBC-BBE02D001D8C} - System32\Tasks\AdobeAAMUpdater-1.0-Golfstar1-Bíba => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {B3B71E96-A33F-440B-8FA1-3865900981C0} - \Microsoft\Windows\Setup\EOONotify -> No File <==== ATTENTION
Task: {B767CCB0-721D-4365-936A-F57044B527E2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {BE1C3502-DB2A-47FC-B6F3-485E251E3D85} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => %SystemRoot%\ehome\mcupdate.exe
Task: {C4618E97-A197-4099-BC36-3FDC0B8D67D7} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION
Task: {C735C0BA-ABCF-42EB-AE2A-64D8ADB52211} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => %SystemRoot%\ehome\ehPrivJob.exe
Task: {CA9B6304-F9D0-4CD8-8795-195BA6B71B45} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {CBE3C887-0234-4EA7-AE9A-7E22F9F2983C} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => %SystemRoot%\ehome\ehPrivJob.exe
Task: {D192F2CE-6C2E-4245-82F9-D9441F56E6C2} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => %SystemRoot%\ehome\ehPrivJob.exe
Task: {D6C53E4D-4A1F-462B-A9CB-AFCF96F419AF} - System32\Tasks\avastBCLRestartS-1-5-21-1702488835-1983202832-4074137989-1001 => Firefox.exe
Task: {DE4A91E6-8380-4AE9-AC5F-4775F3D9E5BC} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => %SystemRoot%\ehome\ehPrivJob.exe
Task: {E2998301-C997-4304-B296-85E760F01E10} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe
Task: {E53F24DE-2A42-4748-ABBA-57E33C47012B} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {E897ACDC-72BD-41F7-84F6-BED04469039F} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {E8C19607-E8B5-4DE9-8B23-C08E2AA0B1E7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {ED764F08-434F-47C8-9F3C-5F6929DA7934} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1001UA => C:\Users\Golfstar\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-18] (Dropbox, Inc.)
Task: {F2045078-5CC5-44FE-A7CD-83F549CCCAC5} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => %windir%\ehome\MCUpdate.exe
Task: {F40FA315-4B44-48B8-A511-34E818B16087} - \CCleanerSkipUAC -> No File <==== ATTENTION
Task: {FFB1792F-ACDA-43C2-946E-4E09461FF000} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1001Core.job => C:\Users\Golfstar\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1001UA.job => C:\Users\Golfstar\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1003Core.job => C:\Users\Bíba\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-1702488835-1983202832-4074137989-1003UA.job => C:\Users\Bíba\AppData\Local\Facebook\Update\FacebookUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
Shortcut: C:\Users\Golfstar\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Ballduck\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Golfstar\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Ballduck\Application\chrome.exe (Google Inc.)
==================== Loaded Modules (Whitelisted) ==============
2017-03-15 08:39 - 2017-03-04 07:31 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-11-12 00:54 - 2013-06-28 16:28 - 00084616 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2016-09-04 22:40 - 2016-06-14 22:03 - 00367552 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\MessageBus.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 00288192 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamBase.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 01147328 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\libprotobuf.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 03611584 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Poco.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 02665920 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvMdnsPlugin.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 01988544 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvPortForwardPlugin.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 01840576 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\RtspPlugin.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 00207296 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\RtspServer.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 00034240 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_system-vc120-mt-1_58.dll
2016-09-04 22:40 - 2016-06-14 22:03 - 00920000 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_regex-vc120-mt-1_58.dll
2017-04-11 20:25 - 2017-03-28 12:17 - 02656952 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2017-04-11 20:25 - 2017-03-28 12:17 - 02656952 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2017-03-15 08:39 - 2017-03-04 05:19 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-03-15 08:39 - 2017-03-04 05:14 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-04-11 20:25 - 2017-03-28 07:01 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-04-11 20:25 - 2017-03-28 07:04 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-04-27 08:15 - 2016-04-27 08:15 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-07-23 10:42 - 2016-07-23 10:42 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-07-23 10:03 - 2016-11-14 13:15 - 00135224 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-09-21 20:20 - 2017-02-19 10:22 - 02493440 _____ () C:\Program Files (x86)\Origin\libGLESv2.dll
2017-04-04 19:20 - 2017-04-04 19:20 - 00170216 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-09-26 19:23 - 2016-09-26 19:23 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-04-04 19:20 - 2017-04-04 19:20 - 00176480 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll
2017-04-04 19:20 - 2017-04-04 19:20 - 00293936 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2017-04-04 19:20 - 2017-04-04 19:20 - 00653520 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2017-03-17 20:22 - 2017-02-01 11:01 - 01870168 _____ () C:\Program Files (x86)\Ballduck\Application\libglesv2.dll
2017-03-17 20:22 - 2017-02-01 11:01 - 00085848 _____ () C:\Program Files (x86)\Ballduck\Application\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Golfstar\Desktop\Fotograf_oponentura_Neználek Rob.doc:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Golfstar\Desktop\Historik_po oponenturách 2-Rob.doc:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Golfstar\Desktop\Odborka_Ježíšův učedník-definitiva.doc:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Golfstar\Desktop\Odborka_Poutník_za_ pravdou-definitiva.doc:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Golfstar\Desktop\Odborka_Znalec_krestan-tradic a bohosluzby-definitiva.doc:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Golfstar\Desktop\Plavec-připomínky-Smurf Rob.doc:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Golfstar\Desktop\Skautský historik_po oponentuře 2 Rob.doc:com.dropbox.attributes [168]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2016-09-04 23:50 - 2016-09-04 23:51 - 00001305 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1702488835-1983202832-4074137989-1001\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg
DNS Servers: 10.0.0.138
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HandyAndy.lnk => C:\Windows\pss\HandyAndy.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Golfstar^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\Golfstar\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: BlueStacks Agent => C:\Program Files (x86)\BlueStacks\HD-Agent.exe
MSCONFIG\startupreg: Dropbox Update => "C:\Users\Golfstar\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{5F40314D-7EA2-40E2-B3A9-D06851200A1D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8DD743E3-8F24-4E16-80EB-C3D942192C56}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{95C4440B-BED8-413C-9A87-0E9062838982}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{879E121C-F5B0-4497-A72C-AC50C4D1E0C2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{EC441F0B-8E7B-4A91-9441-8AB2B1475C12}] => (Allow) C:\Program Files\Andy\SetupFiles\VMwareCheck.exe
FirewallRules: [{F81C4976-F08A-4499-AAE7-005DB2494C0B}] => (Allow) C:\Program Files\Andy\SetupFiles\VMwareCheck.exe
FirewallRules: [{97B8823E-7902-45F7-A06E-FC13F752600B}] => (Allow) C:\Program Files\Andy\SetupFiles\Uninstall.exe
FirewallRules: [{6AFC7242-E8DC-4D81-B1E4-55E466BAB76F}] => (Allow) C:\Program Files\Andy\SetupFiles\Uninstall.exe
FirewallRules: [{148502C5-7BD8-460E-BF01-C92FBED0CD5F}] => (Allow) C:\Program Files\Andy\HandyAndy.exe
FirewallRules: [{09624E5E-1598-4332-B908-B7C26146B6DA}] => (Allow) C:\Program Files\Andy\HandyAndy.exe
FirewallRules: [{1091B4A5-7A93-471E-A531-14DC3646477B}] => (Allow) C:\Program Files\Andy\AndyConsole.exe
FirewallRules: [{10B05572-80A5-4E5A-B5A2-FE8C638BDF3B}] => (Allow) C:\Program Files\Andy\AndyConsole.exe
FirewallRules: [{074C047D-FC44-466B-8B56-C4CB0E23EF31}] => (Allow) C:\Program Files\Andy\andy.exe
FirewallRules: [{83366DAE-DD50-44BF-BDA7-05462ACD0740}] => (Allow) C:\Program Files\Andy\andy.exe
FirewallRules: [{FD22A214-7007-444D-AF46-1006B17EEEA5}] => (Allow) C:\Users\Golfstar\AppData\Local\Temp\andy-x64\Setup.exe
FirewallRules: [{1BD5A653-5DE7-4138-96B8-752DD744FC45}] => (Allow) C:\Users\Golfstar\AppData\Local\Temp\andy-x64\Setup.exe
FirewallRules: [{88566DB5-CB15-4113-9F8D-1B836527F969}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{CC61022C-F455-4A49-8BC0-63435A27C53F}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{17658538-7306-4856-AA3D-E8786B005C70}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{D87C97A7-8587-4F47-8D75-58A0654A12DC}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{A6406223-90A2-49D6-BACC-5AF2BA668F3B}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{A446DAFA-0C04-44F0-B9D7-54F216F8BA8E}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{4BCBEEF8-4379-4731-96C0-8761BC795229}] => (Allow) C:\Games\World_of_Tanks\worldoftanks.exe
FirewallRules: [{D65D6BBC-CA7C-468B-8E43-1515908E5714}] => (Allow) C:\Games\World_of_Tanks\worldoftanks.exe
FirewallRules: [{D0C2102F-47FC-4D3F-892A-1679665716FD}] => (Allow) C:\Games\World_of_Tanks\WoTLauncher.exe
FirewallRules: [{CF1CE978-2BD8-4D28-B35E-524FACB115A7}] => (Allow) C:\Games\World_of_Tanks\WoTLauncher.exe
FirewallRules: [{9C5301F0-14E1-4A9C-AEFD-58A8D4F1FEED}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{1F2CD24F-EB93-420B-9E48-C73095C0B4E0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [UDP Query User{9BD45D29-C7E5-4EAF-89BD-DD09B279C14C}C:\program files (x86)\ccp\eve\bin\exefile.exe] => (Block) C:\program files (x86)\ccp\eve\bin\exefile.exe
FirewallRules: [TCP Query User{DAF6837D-9B69-4F34-BFB3-FF3238808320}C:\program files (x86)\ccp\eve\bin\exefile.exe] => (Block) C:\program files (x86)\ccp\eve\bin\exefile.exe
FirewallRules: [{D5580A2E-9275-4441-AE33-E7B5A44A73B5}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{88D825FB-61E0-4C0C-B4B0-14D6099F9B59}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{0BB3DD57-BEA7-409D-9207-F9CE4806C61F}] => (Allow) C:\Program Files (x86)\GameforgeLive\Games\GBR_eng\S.K.I.L.L\Binaries\Win32\sf2.exe
FirewallRules: [{94A400EF-77F5-4EB1-9BF5-125EB64B4460}] => (Allow) C:\Program Files (x86)\GameforgeLive\Games\GBR_eng\S.K.I.L.L\Binaries\Win32\sf2.exe
FirewallRules: [{4CC3E25E-4D64-4746-A65A-CC63646081A3}] => (Allow) C:\Program Files (x86)\GameforgeLive\gfl_client.exe
FirewallRules: [UDP Query User{8EEABDE4-8AE9-4A61-A121-1EBA5B7CD466}C:\users\golfstar\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\golfstar\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{77428CDA-1B5D-48BB-977E-6E2406BD7042}C:\users\golfstar\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\golfstar\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{1408C129-BF8E-472B-A935-B993C5570F9F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3C5CB880-B2B6-4BF2-AAB2-A844EE96C40B}] => (Allow) C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{6D11B4DE-51DB-4E1A-BB63-A7EAA50BFB3C}] => (Allow) C:\Users\Golfstar\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{8B805305-EE58-4A7A-A21D-5B2E8E69D006}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{91204E13-A122-42CB-865A-7716B615ACD5}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivlauncher.exe
FirewallRules: [{D8A94AC4-0374-46C2-B469-8F03BBF6B53E}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivlauncher.exe
FirewallRules: [{3C5829D9-3E81-4E27-B55B-EE83A40E9443}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivboot.exe
FirewallRules: [{BFA072F4-30B2-452B-AE75-FE4AEF4911CB}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivboot.exe
FirewallRules: [{821060F5-9E41-435F-8259-0481B0E9CB1A}] => (Allow) C:\ProgramData\Turbine\The Lord of the Rings Online\TurbineLauncher.exe
FirewallRules: [{32DAE3F3-AAE2-4CAD-B228-FB84BACB3053}] => (Allow) C:\ProgramData\Turbine\The Lord of the Rings Online\TurbineLauncher.exe
FirewallRules: [{C99281C3-B306-4F89-B141-370FDC975970}] => (Allow) C:\ProgramData\Turbine\The Lord of the Rings Online\lotroclient.exe
FirewallRules: [{F17FEA22-420F-4BB8-8606-BF643899EED2}] => (Allow) C:\ProgramData\Turbine\The Lord of the Rings Online\lotroclient.exe
FirewallRules: [{80EA73E5-5E84-4430-AB51-2EF40B9B75B6}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 1 Open Beta\bf1.exe
FirewallRules: [{F9A313C9-E9BB-4F16-A983-BECFB4E3685C}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 1 Open Beta\bf1.exe
FirewallRules: [{AB3265CB-46BF-47FB-9411-3F6834FAFF5D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{C45C517B-E064-43EC-81CD-5D192391E0A3}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{0698AEB3-8857-4FA2-8D1B-009BAA1A2C92}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{7B08F3F5-7158-46FA-A0C0-FBAB85A324C1}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{5924DDB8-55AA-4100-A1A5-36B323FB541E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{4648FBD4-370B-4A36-B0E2-5BF9510D6C44}] => (Allow) C:\Hry\WarThunder\run.exe
FirewallRules: [{B2B3DC6F-33FD-4497-8A3A-FCB4D6D6D543}] => (Allow) C:\Hry\WarThunder\run.exe
FirewallRules: [{0C3C6FD3-793D-4ECD-90AB-2E181526EB0B}] => (Allow) LPort=80
FirewallRules: [{32E95327-A1F9-40CA-A5CB-BE755386E5B0}] => (Allow) LPort=443
FirewallRules: [{48EC70E6-BF81-4570-948B-E35E6D924386}] => (Allow) LPort=20010
FirewallRules: [{AC62C566-A783-45A4-80D9-57F3BC0001FC}] => (Allow) LPort=3478
FirewallRules: [{F17944BD-8336-4250-AB2F-9FAC54F58CDB}] => (Allow) LPort=7850
FirewallRules: [{8300C4B9-8EC2-43DE-A760-B85A85C8F03C}] => (Allow) LPort=7852
FirewallRules: [{BAE68FCA-C985-487A-ABC8-022AB0EABCD5}] => (Allow) LPort=7853
FirewallRules: [{3FD84B3C-92FA-459D-B9B2-F9D1D4F42541}] => (Allow) LPort=27022
FirewallRules: [{4CE2B0F9-82DA-483C-B6DA-A9E2074F6C69}] => (Allow) LPort=6881
FirewallRules: [{F6B0AE0B-22E4-4B3D-82E1-AD470A0D3EA2}] => (Allow) LPort=33333
FirewallRules: [{113407A7-43A5-4544-9443-D27AE39BCFE3}] => (Allow) LPort=20443
FirewallRules: [{97374C6D-2B12-40C5-962E-F3067A8804B9}] => (Allow) LPort=8090
FirewallRules: [TCP Query User{34AC58FC-F38D-4E0F-8671-946D6111DA62}C:\hry\warthunder\win64\aces.exe] => (Block) C:\hry\warthunder\win64\aces.exe
FirewallRules: [UDP Query User{FCC0F02D-5017-49B3-8EFF-36F00C089953}C:\hry\warthunder\win64\aces.exe] => (Block) C:\hry\warthunder\win64\aces.exe
FirewallRules: [{09E5C13B-C2A3-4A15-B21C-1AAF9F5A1931}] => (Allow) C:\Program Files (x86)\Opera\43.0.2442.1144\opera.exe
FirewallRules: [{B1AC82C5-2BA4-4D7B-82AB-7862FFAB2EC6}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.590\SZBrowser.exe
FirewallRules: [{B4057743-F6B8-4DDB-9128-6C0511197398}] => (Allow) C:\Program Files (x86)\Ballduck\Application\chrome.exe
FirewallRules: [{4D1F44E0-AE2A-4EF2-B238-352B4F161776}] => (Allow) C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe
FirewallRules: [{20FE4D0D-3C8F-469B-91C3-A4049A72BB86}] => (Allow) C:\Program Files (x86)\Firefox\Firefox.exe
FirewallRules: [{272BF586-ACC4-479E-9B33-584AA0E96F3E}] => (Allow) C:\Program Files (x86)\Opera\44.0.2510.857\opera.exe
FirewallRules: [{280CCEF0-8DCC-4B07-97A8-077084540CD3}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.596\SZBrowser.exe
FirewallRules: [{FACF7159-EF9E-466C-B166-DDC4DEEE4B65}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{22C6373D-779A-4F87-B1F3-95D620336247}] => (Allow) C:\Program Files (x86)\MIO\loader\wdcxwd10eads-00m2b0_wd-wcav5494550345503.dat
FirewallRules: [{A0777183-AEAA-4324-BE10-072054CBB63B}] => (Allow) C:\Program Files (x86)\MIO\loader\wdcxwd10eads-00m2b0_wd-wcav5494550345503.dat
==================== Restore Points =========================
06-04-2017 08:13:02 Naplánovaný kontrolní bod
11-04-2017 20:56:42 Windows Update
12-04-2017 19:02:09 JRT Pre-Junkware Removal
13-04-2017 23:26:08 JRT Pre-Junkware Removal
15-04-2017 00:17:53 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/15/2017 12:18:17 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Protokol Microsoft LLDP (Link-Layer Discovery Protocol).
System Error:
Přístup byl odepřen.
.
Error: (04/15/2017 12:17:53 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Chyba služby Stínová kopie svazků: Při volání rutiny ConvertStringSidToSid(S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415.bak) došlo k neočekávané chybě. hr= 0x80070539, Struktura ID zabezpečení není platná.
.
Operace:
Událost OnIdentify
Shromažďování dat modulu pro zápis
Kontext:
Kontext spuštění: Shadow Copy Optimization Writer
ID třídy modulu pro zápis: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Název modulu pro zápis: Shadow Copy Optimization Writer
ID instance modulu pro zápis: {90353b78-bb96-46c1-8c70-0c891655d545}
Error: (04/14/2017 11:50:51 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Program UFO.exe verze 0.0.0.0 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Zabezpečení a údržba.
ID procesu: 12bc
Čas spuštění: 01d2b5659da9b36f
Čas ukončení: 4294967295
Cesta k aplikaci: C:\Program Files (x86)\CENEGA\UFO Aftermath\UFO.exe
ID hlášení: 6c3bfa49-215c-11e7-802d-002421e462e3
Úplný název balíčku s chybou:
ID aplikace související s balíčkem s chybou:
Error: (04/14/2017 11:25:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Program UFO.exe verze 0.0.0.0 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Zabezpečení a údržba.
ID procesu: d08
Čas spuštění: 01d2b5655ecb698f
Čas ukončení: 35
Cesta k aplikaci: C:\Program Files (x86)\CENEGA\UFO Aftermath\UFO.exe
ID hlášení: d5e74da1-2158-11e7-802d-002421e462e3
Úplný název balíčku s chybou:
ID aplikace související s balíčkem s chybou:
Error: (04/14/2017 11:23:26 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Program UFO.exe verze 0.0.0.0 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Zabezpečení a údržba.
ID procesu: 1600
Čas spuštění: 01d2b5653070a479
Čas ukončení: 39
Cesta k aplikaci: C:\Program Files (x86)\CENEGA\UFO Aftermath\UFO.exe
ID hlášení: 94c29c22-2158-11e7-802d-002421e462e3
Úplný název balíčku s chybou:
ID aplikace související s balíčkem s chybou:
Error: (04/14/2017 11:22:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Program UFO.exe verze 0.0.0.0 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Zabezpečení a údržba.
ID procesu: 1008
Čas spuštění: 01d2b564bd5f8a03
Čas ukončení: 37
Cesta k aplikaci: C:\Program Files (x86)\CENEGA\UFO Aftermath\UFO.exe
ID hlášení: 64b55e6b-2158-11e7-802d-002421e462e3
Úplný název balíčku s chybou:
ID aplikace související s balíčkem s chybou:
Error: (04/14/2017 09:48:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: NvStreamUserAgent.exe, verze: 7.1.2084.9592, časové razítko: 0x57605c64
Název chybujícího modulu: ntdll.dll, verze: 10.0.10586.672, časové razítko: 0x580ee321
Kód výjimky: 0xc0000005
Posun chyby: 0x000000000002e909
ID chybujícího procesu: 0x118c
Čas spuštění chybující aplikace: 0x01d2b5581fa80d7a
Cesta k chybující aplikaci: C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
Cesta k chybujícímu modulu: C:\WINDOWS\SYSTEM32\ntdll.dll
ID zprávy: 7408813a-a58b-481a-acdd-bd185b8585af
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:
Error: (04/14/2017 09:32:42 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Generování kontextu aktivace pro C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKCmdDefrag.dll se nezdařilo.
Závislé sestavení Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.
Error: (04/14/2017 09:32:42 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Generování kontextu aktivace pro C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKCmdFS.dll se nezdařilo.
Závislé sestavení Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.
Error: (04/14/2017 09:32:41 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Generování kontextu aktivace pro C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKEngine.dll se nezdařilo.
Závislé sestavení Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.
System errors:
=============
Error: (04/15/2017 12:18:49 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba NVIDIA Display Driver Service byla neočekávaně ukončena. Tento stav nastal již 1krát.
Error: (04/15/2017 12:13:21 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Služba NetTcpActivator závisí na službě NetTcpPortSharing, která neuspěla při spuštění v důsledku následující chyby:
Zvolenou službu nelze spustit, protože není povolena nebo s ní není spojeno žádné povolené zařízení.
Error: (04/15/2017 12:13:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Služba VMnetBridge neuspěla při spuštění v důsledku následující chyby:
Systém nemůže nalézt uvedený soubor.
Error: (04/15/2017 12:11:57 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Hostitel synchronizace_83c843 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restartovat službu.
Error: (04/15/2017 12:11:44 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba Disc Soft Lite Bus Service byla neočekávaně ukončena. Tento stav nastal již 1krát.
Error: (04/15/2017 12:11:44 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Windows Search byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 30000 milisekund: Restartovat službu.
Error: (04/15/2017 12:11:44 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba NVIDIA Streamer Network Service byla neočekávaně ukončena. Tento stav nastal již 1krát.
Error: (04/15/2017 12:11:44 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba Origin Web Helper Service byla neočekávaně ukončena. Tento stav nastal již 1krát.
Error: (04/15/2017 12:11:44 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba NVIDIA Streamer Service byla neočekávaně ukončena. Tento stav nastal již 1krát.
Error: (04/15/2017 12:11:44 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Řízení front zpráv byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 120000 milisekund: Restartovat službu.
CodeIntegrity:
===================================
Date: 2017-04-11 21:51:44.595
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-04-06 23:37:06.530
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\msiexec.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Sophos\Sophos Virus Removal Tool\SVRTcli.exe that did not meet the Microsoft signing level requirements.
Date: 2017-03-30 06:56:32.071
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-03-19 18:08:42.263
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-03-18 07:06:09.150
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2017-03-18 06:23:12.774
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2017-03-18 06:23:12.643
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2017-03-18 00:37:36.324
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2017-03-17 22:18:33.505
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2017-03-17 22:16:10.706
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5 CPU 750 @ 2.67GHz
Percentage of memory in use: 24%
Total physical RAM: 8183.11 MB
Available physical RAM: 6214.96 MB
Total Virtual: 16375.11 MB
Available Virtual: 14384.06 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:931.41 GB) (Free:642.67 GB) NTFS
Drive d: (Rezervováno systémem) (Fixed) (Total:0.1 GB) (Free:0.01 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive e: (KRD10) (CDROM) (Total:0.29 GB) (Free:0 GB) CDFS
Drive f: (Zaloha) (Fixed) (Total:111.8 GB) (Free:11.2 GB) NTFS
Drive g: (201007251918) (CDROM) (Total:1.13 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 7A0FD819)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 111.8 GB) (Disk ID: 1D551D54)
Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================