VIRY.CZ

Dobry den, prosim o pomoc, uz jsem bezradny.
Pocitac procisten nekolika programy, ale vsechny prohlizece obcas odmitaji nacist webovou stranku.
Internetove pripojeni je v poradku.

Zde je log:

Logfile of random's system information tool 1.16 (written by random/random)
Run by PC at 2017-05-08 11:22:44
Microsoft Windows 7 Professional
System drive C: has 228 GB (75%) free of 305 GB
Total RAM: 3871 MB (27% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:24:19, on 8.5.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18639)
Boot mode: Normal

Running processes:
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe
C:\Program Files\ThinkPad\Bluetooth Software\Bluetooth Headset Helper.exe
C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
C:\Program Files\trend micro\PC_RSITx64.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.cz/?gfe_rd=cr&ei=_f8 ... =ssl#spf=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll
O4 - HKLM\..\Run: [PWMTRV] rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [IMSS] "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [RotateImage] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files (x86)\Digital Line Detect\DLG.exe
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{188F5398-8881-43B3-ADA8-B61A7DFF6BE0}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{1EDAEE71-673D-4DF0-9D04-E2034A310C93}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{202E7AAF-2584-40D3-9169-60B6DAD619DF}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{29AF921B-5F20-4AAE-9A4A-BCA5F2DEF44D}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{30D86D8B-2C59-46E0-8B60-06DA6DF1E266}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{3348A0D7-4558-491F-81CE-7C6F110DA21E}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A20815E-01EC-4BD4-9EF8-9234B1B147ED}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{605F2096-7325-42DB-A22C-13C053B03D20}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{846ee342-7039-11de-9d20-806e6f6e6963}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A17FC28-21DF-45A4-98FA-0AED85926008}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{A23611C8-B1EA-4076-8E53-64E7149BF592}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{FFBE0C14-C8BE-48E3-84B4-DE53BB435A57}: NameServer = 8.8.8.8
O17 - HKLM\System\CS1\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 8.8.8.8
O17 - HKLM\System\CS2\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Identity Protection Technology Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo EasyPlus Hotspot - Lenovo - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Lenovo Platform Service (LPlatSvc) - Unknown owner - C:\Windows\system32\LPlatSvc.exe (file missing)
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: Power Manager Service (Power Manager DBC Service) - Lenovo - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Samsung UPD Utility Service (SamsungUPDUtilSvc) - Unknown owner - C:\Windows\SysWOW64\SecUPDUtilSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ShareItSvc - SHAREit Technologies Co.Ltd - C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files (x86)\Lenovo\System Update\SUService.exe
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11369 bytes

====== Enumerating Processes ======

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ibmpmsvc.exe
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\system32\taskhost.exe
"C:\Windows\system32\Dwm.exe"
"C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
C:\Windows\system32\svchost.exe -k HsfXAudioService
"C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe"
"C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe"
"C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe"
C:\Windows\SysWOW64\SecUPDUtilSvc.exe
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe
"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
C:\Windows\system32\rundll32.exe "C:\Program Files\LENOVO\HOTKEY\hotkey.dll",InstallAudioHotkeyHook
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.FullScreenMagnifier
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
"C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe"
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe"
"C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe"
"C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe" -Embedding
"C:\Program Files\ThinkPad\Bluetooth Software\Bluetooth Headset Helper.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE"
"C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe" -Embedding
"C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe" -Embedding
"C:\Program Files\Microsoft Security Client\msseces.exe"
"c:\program files (x86)\teamviewer\TeamViewer_Desktop.exe" --IPCport 5939
C:\Windows\explorer.exe
"c:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Users\PC\Downloads\RSITx64.exe"

====== Scheduled tasks folder ======

C:\Windows\system32\tasks\Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\system32\tasks\Adobe Flash Player Updater - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\system32\tasks\klcp_update - "C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe" /verysilent /update /freq=30
C:\Windows\system32\tasks\PMTask - C:\Program Files (x86)\ThinkPad\Utilities\PwmIdTsv.exe
C:\Windows\system32\tasks\SidebarExecute - C:\Program Files (x86)\Windows Sidebar\sidebar.exe /showGadgets
C:\Windows\system32\tasks\Synaptics TouchPad Enhancements - \Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\tasks\{0D1AEFEE-2309-F090-AF3D-12B63B9FF166} - C:\Windows\system32\regsvr32.exe /s /n /i:"/rt" "C:\PROGRA~3\207d4732\768720c1.dll"
C:\Windows\system32\tasks\{87EB3D5C-6FA0-4A1D-83AA-B32F937AD1B7} - "c:\program files (x86)\mozilla firefox\firefox.exe" http://ui.skype.com/ui/0/7.23.0.105/cs/ ... =tsInstall
C:\Windows\system32\tasks\WPD\SqmUpload_S-1-5-21-1790732064-3310509644-602799907-1000 - %windir%\system32\rundll32.exe portabledeviceapi.dll,#1
C:\Windows\system32\tasks\TVT\TVSUUpdateTask - "C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe" /CM -search C -action INSTALL -includerebootpackages 1,3,4 -noicon -noreboot -nolicense -defaultupdate -schtask
C:\Windows\system32\tasks\TVT\TVSUUpdateTask_UserLogOn - "C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe" PendingTask
C:\Windows\system32\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask - %systemroot%\system32\sc.exe start osppsvc
C:\Windows\system32\tasks\Microsoft\Windows\WindowsBackup\ConfigNotification - %systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
C:\Windows\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\Windows\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\Windows\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -queuereporting
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask - %SystemRoot%\system32\Wat\WatAdminSvc.exe /run
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline - %SystemRoot%\system32\schtasks.exe /run /I /TN "\Microsoft\Windows\Windows Activation Technologies\ValidationTask"
C:\Windows\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\Windows\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
C:\Windows\system32\tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask - sc.exe start sppsvc
C:\Windows\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\Windows\system32\tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem - %SystemRoot%\System32\powercfg.exe -energy -auto
C:\Windows\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\Windows\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService - %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks - %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ehDRMInit - %SystemRoot%\ehome\ehPrivJob.exe /DRMInit
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\InstallPlayReady - %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\mcupdate - %SystemRoot%\ehome\mcupdate $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURActivate - %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURDiscovery - %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscovery - %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 - %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 - %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PeriodicScanRetry - %windir%\ehome\MCUpdate.exe -pscn 0
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrScheduleTask - %SystemRoot%\ehome\mcupdate.exe -PvrSchedule
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RecordingRestart - %SystemRoot%\ehome\ehrec /RestartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RegisterSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ReindexSearchRoot - %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\StartRecording - %SystemRoot%\ehome\ehrec /StartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\UpdateRecordPath - %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotifications.exe
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\Windows\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\Windows\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\AitAgent - aitagent
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattel\DiagTrackRunner.exe /UploadEtlFilesOnly
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\Windows\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\Windows\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe
C:\Windows\system32\tasks\Microsoft\Office\Office 15 Subscription Heartbeat - %ProgramFiles%\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
C:\Windows\system32\tasks\Microsoft\Office\OfficeTelemetryAgentFallBack - "C:\Program Files\Microsoft Office\Office15\msoia.exe" scan upload mininterval:2880
C:\Windows\system32\tasks\Microsoft\Office\OfficeTelemetryAgentLogOn - "C:\Program Files\Microsoft Office\Office15\msoia.exe" scan upload
C:\Windows\system32\tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan - c:\Program Files\Microsoft Security Client\\MpCmdRun.exe Scan -ScheduleJob -RestrictPrivileges
C:\Windows\system32\tasks\Lenovo\Lenovo Customer Feedback Program 64 - "%ProgramFiles(x86)%\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe"
C:\Windows\system32\tasks\Lenovo\Lenovo Customer Feedback Program 64 35 - "%ProgramFiles(x86)%\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe"
C:\Windows\system32\tasks\Lenovo\Message Center Plus Launcher - "%programfiles(x86)%\Lenovo\message center plus\mcplaunch.exe" /start
C:\Windows\system32\tasks\AVAST Software\Avast settings backup - C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe /backup /iavs

=========Mozilla firefox=========

ProfilePath - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.148 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_148.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\SysWOW64\Adobe\Director\np32dsw_1224194.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]
"Description"=This plugin updates Intel WebAPI component
"Path"=C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.131.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.131.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_131\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/Lync,version=15.0]
"Description"=Microsoft Lync Plug-in for Firefox
"Path"=C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nokia.com/EnablerPlugin]
"Description"=Nokia Suite Enabler Plugin
"Path"=C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.148 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_148.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.131.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.131.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre1.8.0_131\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.2.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll


C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default\addons.json
Mozilla Firefox hotfix - extension - firefox-hotfix@mozilla.org

C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default\extensions.json
Shield Recipe Client - extension - shield-recipe-client@mozilla.org - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default\features\{187b514d-40fc-4cfb-8bf4-69841788027a}\shield-recipe-client@mozilla.org.xpi
Application Update Service Helper - extension - aushelper@mozilla.org - C:\Program Files (x86)\Mozilla Firefox\browser\features\aushelper@mozilla.org.xpi
Multi-process staged rollout - extension - e10srollout@mozilla.org - C:\Program Files (x86)\Mozilla Firefox\browser\features\e10srollout@mozilla.org.xpi
Pocket - extension - firefox@getpocket.com - C:\Program Files (x86)\Mozilla Firefox\browser\features\firefox@getpocket.com.xpi
Web Compat - extension - webcompat@mozilla.org - C:\Program Files (x86)\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi
Default - theme - {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi

C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default\pluginreg.dat
Plugin - Shockwave Flash - 25.0.0.148 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_148.dll

=========Google Chrome=========

C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Extension aapocclcgogkmnckokdopfmhonfmgoek 1 Prezentace Google 0.9
Extension ahfgeienlihckogmohjhadlkjgocpleb 1 Obchod Chrome 0.2
Extension aohghmighlieiainnegkcijnfilokake 1 Dokumenty Google 0.9
Extension apdfllckaahabafndbhieahigkjlhalf 1 Disk Google 14.1
Extension bepbmhgboaologfdajaanbcjmnhjmhfn 0
Extension bgjpfhpjcgdppjbgnpnjllokbmcdllig 1 Seznam Lištička - Email 1.4.2
Extension blmojkbhnkkphngknkmgccmlenfaelkd 1 Seznam Lištička - Slovník 1.4.6
Extension blpcfgokakmgnkcojhhkbfbldkacnbeo 1 YouTube 4.2.8
Extension eemcgdkfndhakfknompkggombfjjjeno 1 Bookmark Manager 0.1
Extension ennkphjdgehloodpbhlhldgbnhmacadg 1 Settings 0.2
Extension eofcbnmajmjmplflapaojjnihcjkigck 2 Avast SafePrice 11.1.0.221
Extension felcaaldnbdncclmgdcncolpebgiejap 1 Tabulky Google 1.1
Extension fngmhnnpilhplaeedifhccceomclgfbg 1 Tables 78.0
Extension gfdkimpbcpahaombhbimeihdjnejgicl 1 Feedback 1.0
Extension ghbmnnjooekpmoecnnnilnnbdlolhkhi 1 Dokumenty Google offline 1.4
Extension gighmmpiobklfepjocnamgkkbiglidom 1 AdBlock 3.10.0
Extension kmendfapggjehodndflmmgagdbamhnfd 1 CryptoTokenExtension 0.9.46
Extension mfehgcgbbipciphmccgaenjidiccnmng 1 Cloud Print 0.1
Extension mfffpogegjflfpflabcdkioaeobkgjik 1 GaiaAuthExtension 0.0.1
Extension mgndgikekgjfcpckkfioiadnlibdjbkf 1 Chrome 0.1
Extension mhjfbmdgcfjbbpaeojofohoefgiehjai 1 Chrome PDF Viewer 1
Extension neajdppkdcdipfabeoofebfddakdcjhd 1 Google Network Speech 1.0
Extension nkeimhogjdpnpccoofpliimaahmaaome 1 Google Hangouts 1.3.2
Extension nmmhkkegccagdldgiimedpiccmgmieda 1 Platby Internetového obchodu Chrome 1.0.0.2
Extension olfeabkoenfaoljndfecamgilllcpiak 0 Seznam Lištička - Rychlá volba 1.9.1
Extension pjkljhegncpnkpknbcohdijeoejaedia 1 Gmail 8.1
Extension pkedcjkdefgpdelpbcmbmeomcjbeemfm 1 Chrome Media Router 5817.313.0.3
Homepage:
default_search_provider.search_url:
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Preferences
Homepage:
default_search_provider.search_url:

======Registry dump ======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2017-03-14 229064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_131\bin\ssv.dll [2017-04-24 571456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-04-24 234560]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll [2017-04-24 473152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL [2017-02-23 1743664]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-04-24 186944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SAIICpl.exe [2009-11-15 307768]
"LENOVO.TPKNRRES"=C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [2013-05-29 60920]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2016-03-02 183216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2016-03-02 411056]
"Persistence"=C:\Windows\system32\igfxpers.exe [2016-03-02 453544]
"CDAServer"=C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [2014-09-08 464608]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2016-11-14 1353680]
"Malwarebytes TrayApp"=C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2017-01-20 2780112]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2017-03-14 27545048]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"PWMTRV"=rundll32 C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL,PwrMgrBkGndMonitor []
"IMSS"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [2013-07-02 113656]
"RotateImage"=C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [2008-10-30 55808]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2017-03-15 587288]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
Digital Line Detect.lnk - C:\Program Files (x86)\Digital Line Detect\DLG.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\System32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\SYSTEM32\igfxdev.dll [2016-03-02 451584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages" = scecli
C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableCAD"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"StubPath" = "C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.96\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux1"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"wave9"=wdmaud.drv
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv
"aux3"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"vidc.iv50"=ir50_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iv32"=ir32_32.dll
"vidc.iv31"=ir32_32.dll
"msacm.iac2"=C:\Windows\system32\iac25_32.ax

====== File associations ======

.ini - open - "%SystemRoot%\system32\NOTEPAD.EXE" %1
.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - "%SystemRoot%\system32\NOTEPAD.EXE" %1

====== List of files/folders created in the last 1 month ======

2017-05-08 11:22:44 ----D---- C:\rsit
2017-05-08 11:22:44 ----D---- C:\Program Files\trend micro
2017-05-08 11:10:01 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2017-05-08 11:09:56 ----D---- C:\Program Files\Mozilla Firefox
2017-05-08 10:54:54 ----SHD---- C:\$RECYCLE.BIN
2017-05-08 10:54:47 ----D---- C:\Windows\temp
2017-05-08 10:54:45 ----A---- C:\ComboFix.txt
2017-05-08 10:41:23 ----A---- C:\Windows\zip.exe
2017-05-08 10:41:23 ----A---- C:\Windows\SWSC.exe
2017-05-08 10:41:23 ----A---- C:\Windows\SWREG.exe
2017-05-08 10:41:23 ----A---- C:\Windows\sed.exe
2017-05-08 10:41:23 ----A---- C:\Windows\PEV.exe
2017-05-08 10:41:23 ----A---- C:\Windows\NIRCMD.exe
2017-05-08 10:41:23 ----A---- C:\Windows\MBR.exe
2017-05-08 10:41:23 ----A---- C:\Windows\grep.exe
2017-05-08 10:39:50 ----D---- C:\Qoobox
2017-05-08 10:39:28 ----D---- C:\Windows\erdnt
2017-05-07 21:15:19 ----D---- C:\Users\PC\AppData\Roaming\Mozilla
2017-05-07 20:54:07 ----A---- C:\Windows\system32\drivers\MBAMChameleon.sys
2017-05-07 20:54:06 ----A---- C:\Windows\system32\drivers\mwac.sys
2017-05-07 20:54:06 ----A---- C:\Windows\system32\drivers\farflt.sys
2017-05-07 20:54:03 ----A---- C:\Windows\system32\drivers\mbam.sys
2017-05-07 20:53:30 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2017-05-07 20:53:18 ----A---- C:\Windows\system32\drivers\mbae64.sys
2017-05-07 20:53:11 ----D---- C:\ProgramData\Malwarebytes
2017-05-07 20:53:11 ----D---- C:\Program Files\Malwarebytes
2017-05-07 19:52:04 ----D---- C:\Program Files (x86)\MozBackup
2017-05-06 19:06:24 ----D---- C:\Program Files\Common Files\adaware
2017-05-06 19:05:40 ----D---- C:\ProgramData\Lavasoft
2017-05-06 15:11:25 ----D---- C:\ProgramData\Spybot - Search & Destroy
2017-05-06 15:11:08 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-05-06 14:40:46 ----D---- C:\Program Files\61GIPRPJJP
2017-05-06 14:35:51 ----D---- C:\ProgramData\{B58DB328-0226-0483-C45B-94C93C8C56C3}
2017-05-06 14:35:03 ----D---- C:\Users\PC\AppData\Roaming\VDI
2017-05-06 14:34:24 ----D---- C:\Program Files\ID6PRZNMNG
2017-05-06 14:34:18 ----D---- C:\Program Files\B8U9ZQ4633
2017-05-06 14:34:12 ----D---- C:\Program Files\I091IWDH8V
2017-04-24 22:13:26 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-64.dll
2017-04-12 21:41:51 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2017-04-12 21:41:51 ----A---- C:\Windows\system32\rdpcorets.dll
2017-04-12 21:41:50 ----A---- C:\Windows\system32\mshtml.dll
2017-04-12 21:41:49 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-04-12 21:41:48 ----A---- C:\Windows\system32\ieframe.dll
2017-04-12 21:41:46 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-04-12 21:41:45 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-04-12 21:41:45 ----A---- C:\Windows\system32\wininet.dll
2017-04-12 21:41:44 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-04-12 21:41:44 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\wuaueng.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\win32k.sys
2017-04-12 21:41:44 ----A---- C:\Windows\system32\urlmon.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\ole32.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\iertutil.dll
2017-04-12 21:41:43 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-04-12 21:41:43 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\wucltux.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\wuapi.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\win32spl.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\samsrv.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\ucrtbase.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\quartz.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\msfeeds.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\cdosys.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\atmfd.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\quartz.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2017-04-12 21:41:41 ----A---- C:\Windows\system32\gdi32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\ucrtbase.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\iedkcs32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l2-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\jscript.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-12 21:41:38 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-04-12 21:41:38 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-04-12 21:41:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-04-12 21:41:36 ----A---- C:\Windows\system32\ntdll.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\mfmjpegdec.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\asycfilt.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\webcheck.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\samlib.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\mfmjpegdec.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\jscript9.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-04-12 21:41:35 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-04-12 21:41:35 ----A---- C:\Windows\system32\asycfilt.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\samlib.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\cdosys.dll
2017-04-12 21:41:34 ----A---- C:\Windows\system32\rdpudd.dll
2017-04-12 21:41:34 ----A---- C:\Windows\system32\ie4uinit.exe
2017-04-12 21:41:34 ----A---- C:\Windows\system32\certcli.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\wups.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wuwebv.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wups2.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wups.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wudriver.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\vbscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\srcore.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\rpcrt4.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\ieapfltr.dll
2017-04-12 21:41:32 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2017-04-12 21:41:32 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\wuauclt.exe
2017-04-12 21:41:32 ----A---- C:\Windows\system32\lsasrv.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\ieui.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\dxtrans.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\dxtmsft.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-04-12 21:41:31 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\srclient.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\smss.exe
2017-04-12 21:41:31 ----A---- C:\Windows\system32\msrating.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\mshtmled.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\kerberos.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\advapi32.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\WinSetupUI.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\rstrui.exe
2017-04-12 21:41:30 ----A---- C:\Windows\system32\occache.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\kernel32.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\jscript9diag.dll
2017-04-12 21:41:29 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\schannel.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-12 21:41:29 ----A---- C:\Windows\system32\jsproxy.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\ieUnatt.exe
2017-04-12 21:41:29 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-04-12 21:41:29 ----A---- C:\Windows\system32\conhost.exe
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\wow64win.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\winsrv.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\ncrypt.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\msv1_0.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\KernelBase.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\inseng.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\wuapp.exe
2017-04-12 21:41:27 ----A---- C:\Windows\system32\wdigest.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\TSpkg.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\sspicli.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\iesetup.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\wow64.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\rpchttp.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\iernonce.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-04-12 21:41:26 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-04-12 21:41:26 ----A---- C:\Windows\system32\csrsrv.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\cdd.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\bcrypt.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-04-12 21:41:25 ----A---- C:\Windows\system32\drivers\appid.sys
2017-04-12 21:41:25 ----A---- C:\Windows\system32\cryptbase.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\wow64cpu.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\sspisrv.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\lsass.exe
2017-04-12 21:41:24 ----A---- C:\Windows\system32\lpk.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\secur32.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\fontsub.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\dciman32.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\appidsvc.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\appidapi.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\lpk.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\ntvdm64.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\credssp.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\auditpol.exe
2017-04-12 21:41:22 ----A---- C:\Windows\system32\atmlib.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-04-12 21:41:22 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\user.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\tzres.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\tzres.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\msaudite.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\apisetschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\adtschema.dll
2017-04-12 21:41:19 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-04-12 21:41:19 ----A---- C:\Windows\system32\msobjs.dll
2017-04-12 21:41:19 ----A---- C:\Windows\system32\ieetwcollectorres.dll

====== List of files/folders modified in the last 1 month ======

2017-05-08 11:22:44 ----RD---- C:\Program Files
2017-05-08 11:16:28 ----D---- C:\Users\PC\AppData\Roaming\Skype
2017-05-08 11:15:03 ----D---- C:\Program Files (x86)\TeamViewer
2017-05-08 11:15:00 ----D---- C:\Windows\System32
2017-05-08 11:14:59 ----D---- C:\Windows\inf
2017-05-08 11:14:59 ----D---- C:\Windows
2017-05-08 11:10:01 ----RD---- C:\Program Files (x86)
2017-05-08 11:02:16 ----D---- C:\Program Files (x86)\Mozilla Firefox
2017-05-08 10:50:58 ----A---- C:\Windows\system.ini
2017-05-08 10:50:47 ----D---- C:\Windows\system32\drivers\etc
2017-05-08 10:50:06 ----D---- C:\Windows\SysWOW64
2017-05-08 10:48:28 ----D---- C:\Windows\Prefetch
2017-05-08 10:46:50 ----D---- C:\Windows\SYSWOW64\drivers
2017-05-08 10:46:50 ----D---- C:\Windows\AppPatch
2017-05-08 10:46:49 ----D---- C:\Program Files (x86)\Common Files
2017-05-08 10:39:51 ----D---- C:\Windows\system32\drivers
2017-05-08 10:35:18 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-05-08 07:59:22 ----D---- C:\Windows\system32\config
2017-05-08 07:43:12 ----A---- C:\Windows\SYSWOW64\log.txt
2017-05-07 20:53:11 ----D---- C:\ProgramData
2017-05-07 20:50:25 ----SHD---- C:\Windows\Installer
2017-05-07 20:46:01 ----D---- C:\Program Files (x86)\Google
2017-05-07 20:45:22 ----D---- C:\Windows\system32\Tasks
2017-05-07 17:44:57 ----SHD---- C:\System Volume Information
2017-05-07 17:18:40 ----D---- C:\Windows\Tasks
2017-05-07 16:46:45 ----RSD---- C:\Windows\Fonts
2017-05-07 16:46:44 ----D---- C:\Users\PC\AppData\Roaming\TeamViewer
2017-05-07 08:23:43 ----SD---- C:\ProgramData\Microsoft
2017-05-06 19:06:24 ----D---- C:\Program Files\Common Files
2017-05-06 15:30:17 ----D---- C:\Program Files\Common Files\AV
2017-05-06 15:03:48 ----D---- C:\Windows\Panther
2017-05-06 15:03:47 ----D---- C:\Windows\Logs
2017-05-06 15:03:46 ----D---- C:\Windows\Minidump
2017-05-06 15:03:46 ----D---- C:\Windows\debug
2017-05-06 13:25:29 ----D---- C:\ProgramData\Microsoft Help
2017-05-06 13:24:45 ----RSD---- C:\Windows\assembly
2017-05-01 19:32:10 ----D---- C:\Windows\system32\catroot2
2017-04-24 23:40:45 ----D---- C:\ProgramData\Oracle
2017-04-24 22:13:39 ----D---- C:\Program Files (x86)\Java
2017-04-24 22:13:23 ----D---- C:\Program Files\Java
2017-04-24 22:12:24 ----A---- C:\Windows\system32\WindowsAccessBridge-64.dll
2017-04-24 22:11:19 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2017-04-13 19:12:15 ----D---- C:\Windows\LiveKernelReports
2017-04-13 08:08:55 ----D---- C:\Windows\rescache
2017-04-13 07:29:53 ----D---- C:\Windows\winsxs
2017-04-13 07:26:53 ----D---- C:\Windows\SYSWOW64\en-US
2017-04-13 07:26:53 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-04-13 07:26:53 ----D---- C:\Program Files\Internet Explorer
2017-04-13 07:26:51 ----D---- C:\Windows\system32\en-US
2017-04-13 07:26:51 ----D---- C:\Windows\system32\cs-CZ
2017-04-13 07:26:50 ----D---- C:\Windows\system32\Boot
2017-04-13 07:26:50 ----D---- C:\Program Files (x86)\Internet Explorer
2017-04-13 07:08:33 ----D---- C:\Program Files\Microsoft Silverlight
2017-04-13 07:08:33 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2017-04-13 07:07:25 ----D---- C:\Windows\Microsoft.NET
2017-04-13 07:06:53 ----D---- C:\Windows\system32\MRT
2017-04-13 06:57:53 ----AC---- C:\Windows\system32\MRT.exe
2017-04-13 06:53:01 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-04-12 07:43:58 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2017-04-12 07:43:52 ----D---- C:\Windows\system32\Macromed
2017-04-12 07:43:50 ----D---- C:\Windows\SYSWOW64\Macromed

File C:\Windows\system32\winlogon.exe is digitally signed
File C:\Windows\system32\wininit.exe is digitally signed
File C:\Windows\explorer.exe is digitally signed
File C:\Windows\SysWOW64\explorer.exe is digitally signed
File C:\Windows\system32\svchost.exe is digitally signed
File C:\Windows\SysWOW64\svchost.exe is digitally signed
File C:\Windows\system32\services.exe is digitally signed
File C:\Windows\system32\User32.dll is digitally signed
File C:\Windows\SysWOW64\User32.dll is digitally signed
File C:\Windows\system32\userinit.exe is digitally signed
File C:\Windows\SysWOW64\userinit.exe is digitally signed
File C:\Windows\system32\rpcss.dll is digitally signed
File C:\Windows\system32\Drivers\volsnap.sys is digitally signed

====== List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R0 DzHDD64;DzHDD64; C:\Windows\System32\DRIVERS\DzHDD64.sys [2016-04-14 29512]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2012-05-30 569152]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2016-08-25 295000]
R0 nvpciflt;nvpciflt; C:\Windows\system32\DRIVERS\nvpciflt.sys [2013-10-29 30496]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 ESProtectionDriver;Malwarebytes Anti-Exploit; \??\C:\Windows\system32\drivers\mbae64.sys [2017-03-22 77440]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiifx64.sys [2013-05-22 15472]
R1 nvkflt;nvkflt; C:\Windows\system32\DRIVERS\nvkflt.sys [2013-10-29 284448]
R1 TPPWRIF;TPPWRIF; C:\Windows\System32\drivers\Tppwr64v.sys [2016-04-14 29008]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 MBAMChameleon;MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [2017-05-07 186304]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 17024]
R2 risdxc;risdxc; C:\Windows\system32\DRIVERS\risdxc64.sys [2011-05-25 101888]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2014-05-07 11576]
R3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2011-03-04 166016]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 btwampfl;btwampfl Bluetooth filter driver; \??\C:\Windows\system32\drivers\btwampfl.sys [2012-12-04 598808]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2012-05-02 184144]
R3 btwavdt;Bluetooth AVDT; C:\Windows\system32\DRIVERS\btwavdt.sys [2012-03-06 210984]
R3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2011-09-18 39976]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2012-03-06 21544]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2012-06-04 1580704]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2015-10-29 506880]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2016-09-06 82232]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2016-03-02 5384728]
R3 MBAMFarflt;MBAMFarflt; \??\C:\Windows\system32\drivers\farflt.sys [2017-05-08 111544]
R3 MBAMProtection;MBAMProtection; \??\C:\Windows\system32\drivers\mbam.sys [2017-05-08 43968]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2017-05-08 251832]
R3 MBAMWebProtection;MBAMWebProtection; \??\C:\Windows\system32\drivers\mwac.sys [2017-05-08 82720]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2012-11-09 57376]
R3 NETw5s64;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2016-08-25 135928]
R3 psadd;Lenovo Parties Service Access Device Driver; C:\Windows\system32\DRIVERS\psadd.sys [2009-12-08 37440]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RtlvVga;RtlvVga; C:\Windows\system32\DRIVERS\RtlvVga.sys [2014-03-18 11920]
R3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2014-07-28 45296]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-14 12288]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2014-07-28 461552]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmpx64.sys [2009-09-03 67072]
S2 rimspci;rimspci; C:\Windows\system32\DRIVERS\rimspe64.sys [2009-10-26 61952]
S2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimspx64.sys [2009-09-03 54784]
S2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdpx64.sys [2009-09-03 57856]
S3 ATSwpWDF;AuthenTec TruePrint USB Driver; C:\Windows\System32\Drivers\ATSwpWDF.sys [2010-02-05 736840]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 btusbflt;Bluetooth USB Filter; C:\Windows\system32\drivers\btusbflt.sys [2010-04-09 54824]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CAXHWAZL;CAXHWAZL; C:\Windows\system32\DRIVERS\CAXHWAZL.sys [2009-06-30 292864]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K; C:\Windows\system32\DRIVERS\e1k62x64.sys [2011-07-20 342704]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver; C:\Windows\system32\DRIVERS\e1y62x64.sys [2010-04-07 290008]
S3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2012-11-09 57376]
S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\CAX_DPV.sys [2009-06-30 1486848]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2013-01-23 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2013-01-23 27136]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2013-02-25 194848]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2012-10-17 26112]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter; C:\Windows\system32\DRIVERS\rtwlane.sys [2015-01-06 3709656]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-21 109056]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2013-01-23 9216]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 usbser;USB Modem Driver; C:\Windows\system32\DRIVERS\usbser.sys [2013-08-29 33280]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2013-01-23 9216]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]

====== List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-04-25 83056]
R2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe [2013-05-14 1008344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\cscsvc.dll
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; %SystemRoot%\System32\svchost.exe -k utcsvc;"ServiceDll" = %SystemRoot%\system32\diagtrack.dll
R2 HsfXAudioService;HsfXAudioService; %SystemRoot%\system32\svchost.exe -k HsfXAudioService;"ServiceDll" = C:\Windows\SysWOW64\XAudio64.dll
R2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2016-09-06 180736]
R2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service; C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [2014-07-09 214464]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute; C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [2013-05-29 44024]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-05-27 110128]
R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction; C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2013-05-29 62456]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-07-02 327672]
R2 MBAMService;Malwarebytes Service; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [2017-01-20 4355024]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2016-11-14 119864]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-10-29 893216]
R2 SamsungUPDUtilSvc;Samsung UPD Utility Service; C:\Windows\SysWOW64\SecUPDUtilSvc.exe [2016-05-22 143664]
R2 TeamViewer;TeamViewer 12; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2017-04-25 10888944]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 125424]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2014-05-27 125488]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2013-07-02 2595832]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2016-11-14 361816]
R3 Power Manager DBC Service;Power Manager Service; C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2016-04-14 1668776]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-03-20 105096]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-03-20 125064]
S2 gupdate;Služba Aktualizace Google (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-07 153168]
S2 LPlatSvc;Lenovo Platform Service; C:\Windows\system32\LPlatSvc.exe [2016-09-06 710144]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2017-01-16 317400]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-12 271448]
S3 AppMgmt;@appmgmts.dll,-3250; %SystemRoot%\system32\svchost.exe -k netsvcs;"ServiceDll" = %SystemRoot%\System32\appmgmts.dll
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2016-03-02 290224]
S3 DozeSvc;Lenovo Doze Mode Service; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2016-04-14 326160]
S3 gupdatem;Služba Aktualizace Google (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-07 153168]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-03-25 114688]
S3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [2014-12-05 619776]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-05-04 191944]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-12-08 178760]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 5132888]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; %SystemRoot%\System32\svchost.exe -k PeerDist;"ServiceDll" = %SystemRoot%\system32\peerdistsvc.dll
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2013-04-18 737616]
S3 ShareItSvc;ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [2016-01-20 31176]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\system32\storsvc.dll
S3 SUService;System Update; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [2017-01-18 23416]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\umrdp.dll
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-03-20 51320]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]

-----------------EOF-----------------

Zdravím!
Spusťte tuto utilitu:

Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.

# AdwCleaner v6.046 - Log vytvořen 08/05/2017 v 11:45:51
# Aktualizováno dne 24/04/2017 z Malwarebytes
# Databáze : 2017-05-05.1 [Server]
# Operační systém : Windows 7 Professional Service Pack 1 (X64)
# Uživatelské jméno : PC - PC-PC
# Spuštěno z : C:\Users\PC\Desktop\adwcleaner_6.046.exe
# Mod: Čištění
# Podpora : https://www.malwarebytes.com/support



***** [ Služby ] *****



***** [ Složky ] *****

[-] Složka smazána: C:\Users\PC\AppData\Local\AdvinstAnalytics
[-] Složka smazána: C:\Users\PC\AppData\Roaming\VDI


***** [ Soubory ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Zástupci ] *****



***** [ Naplánované úlohy ] *****



***** [ Registry ] *****

[-] Klíč smazán: HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
[-] Klíč smazán: HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
[-] Klíč smazán: HKU\.DEFAULT\Software\UpgSvr
[-] Klíč smazán: HKU\S-1-5-21-1790732064-3310509644-602799907-1000\Software\Installer
[-] Klíč smazán: HKU\S-1-5-21-1790732064-3310509644-602799907-1000\Software\VDI
[-] Klíč smazán: HKU\S-1-5-21-1790732064-3310509644-602799907-1000\Software\PopWnd
[-] Klíč smazán: HKU\S-1-5-21-1790732064-3310509644-602799907-1000\Software\UpgSvr
[#] Klíč smazán po restartu: HKU\S-1-5-18\Software\UpgSvr
[#] Klíč smazán po restartu: HKCU\Software\Installer
[#] Klíč smazán po restartu: HKCU\Software\VDI
[#] Klíč smazán po restartu: HKCU\Software\PopWnd
[#] Klíč smazán po restartu: HKCU\Software\UpgSvr
[-] Klíč smazán: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\11598763487076930564
[#] Klíč smazán po restartu: [x64] HKCU\Software\Installer
[#] Klíč smazán po restartu: [x64] HKCU\Software\VDI
[#] Klíč smazán po restartu: [x64] HKCU\Software\PopWnd
[#] Klíč smazán po restartu: [x64] HKCU\Software\UpgSvr


***** [ Prohlížeče ] *****



*************************

:: "Tracing" klíče smazány
:: Winsock nastavení vyčištěno

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [2108 Bajty] - [08/05/2017 11:45:51]
C:\AdwCleaner\AdwCleaner[S0].txt - [2409 Bajty] - [08/05/2017 11:45:19]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2254 Bajty] ##########

Dejte nový log RSIT.

Logfile of random's system information tool 1.16 (written by random/random)
Run by PC at 2017-05-08 12:49:25
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 228 GB (75%) free of 305 GB
Total RAM: 3871 MB (50% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:49:43, on 8.5.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18639)
Boot mode: Normal

Running processes:
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
C:\Program Files\ThinkPad\Bluetooth Software\Bluetooth Headset Helper.exe
C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe
C:\Program Files\trend micro\PC_RSITx64.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.cz/?gfe_rd=cr&ei=_f8 ... =ssl#spf=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll
O4 - HKLM\..\Run: [PWMTRV] rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [IMSS] "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [RotateImage] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files (x86)\Digital Line Detect\DLG.exe
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{188F5398-8881-43B3-ADA8-B61A7DFF6BE0}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{1EDAEE71-673D-4DF0-9D04-E2034A310C93}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{202E7AAF-2584-40D3-9169-60B6DAD619DF}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{29AF921B-5F20-4AAE-9A4A-BCA5F2DEF44D}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{30D86D8B-2C59-46E0-8B60-06DA6DF1E266}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{3348A0D7-4558-491F-81CE-7C6F110DA21E}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A20815E-01EC-4BD4-9EF8-9234B1B147ED}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{605F2096-7325-42DB-A22C-13C053B03D20}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{846ee342-7039-11de-9d20-806e6f6e6963}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A17FC28-21DF-45A4-98FA-0AED85926008}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{A23611C8-B1EA-4076-8E53-64E7149BF592}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{FFBE0C14-C8BE-48E3-84B4-DE53BB435A57}: NameServer = 8.8.8.8
O17 - HKLM\System\CS1\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O17 - HKLM\System\CS2\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Identity Protection Technology Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo EasyPlus Hotspot - Lenovo - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Lenovo Platform Service (LPlatSvc) - Unknown owner - C:\Windows\system32\LPlatSvc.exe (file missing)
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: Power Manager Service (Power Manager DBC Service) - Lenovo - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Samsung UPD Utility Service (SamsungUPDUtilSvc) - Unknown owner - C:\Windows\SysWOW64\SecUPDUtilSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ShareItSvc - SHAREit Technologies Co.Ltd - C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files (x86)\Lenovo\System Update\SUService.exe
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11372 bytes

====== Enumerating Processes ======

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ibmpmsvc.exe
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
C:\Windows\system32\svchost.exe -k HsfXAudioService
"C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe"
"C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe"
"C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe"
C:\Windows\SysWOW64\SecUPDUtilSvc.exe
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe
"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"c:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\rundll32.exe "C:\Program Files\LENOVO\HOTKEY\hotkey.dll",InstallAudioHotkeyHook
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.FullScreenMagnifier
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
"C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
"C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\SysWOW64\rundll32.exe
"C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe"
"C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
"C:\Windows\system32\NOTEPAD.EXE" C:\AdwCleaner\AdwCleaner[C0].txt
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"C:\Windows\SysWOW64\RunDll32.exe" "C:\Program Files\ThinkPad\Bluetooth Software\SysWOW64\BtMmHook.dll",SetAndWaitBtMmHook
"C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe" -Embedding
"C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe" -Embedding
"c:\program files (x86)\teamviewer\TeamViewer_Desktop.exe" --IPCport 5939
"C:\Program Files\ThinkPad\Bluetooth Software\Bluetooth Headset Helper.exe"
"C:\Program Files (x86)\Lenovo\System Update\SUService.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe" /start
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE"
C:\Windows\system32\taskeng.exe
"C:\Users\PC\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

====== Scheduled tasks folder ======

C:\Windows\system32\tasks\Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\system32\tasks\Adobe Flash Player Updater - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\system32\tasks\klcp_update - "C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe" /verysilent /update /freq=30
C:\Windows\system32\tasks\PMTask - C:\Program Files (x86)\ThinkPad\Utilities\PwmIdTsv.exe
C:\Windows\system32\tasks\SidebarExecute - C:\Program Files (x86)\Windows Sidebar\sidebar.exe /showGadgets
C:\Windows\system32\tasks\Synaptics TouchPad Enhancements - \Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\tasks\{0D1AEFEE-2309-F090-AF3D-12B63B9FF166} - C:\Windows\system32\regsvr32.exe /s /n /i:"/rt" "C:\PROGRA~3\207d4732\768720c1.dll"
C:\Windows\system32\tasks\{87EB3D5C-6FA0-4A1D-83AA-B32F937AD1B7} - "c:\program files (x86)\mozilla firefox\firefox.exe" http://ui.skype.com/ui/0/7.23.0.105/cs/ ... =tsInstall
C:\Windows\system32\tasks\WPD\SqmUpload_S-1-5-21-1790732064-3310509644-602799907-1000 - %windir%\system32\rundll32.exe portabledeviceapi.dll,#1
C:\Windows\system32\tasks\TVT\TVSUUpdateTask - "C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe" /CM -search C -action INSTALL -includerebootpackages 1,3,4 -noicon -noreboot -nolicense -defaultupdate -schtask
C:\Windows\system32\tasks\TVT\TVSUUpdateTask_UserLogOn - "C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe" PendingTask
C:\Windows\system32\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask - %systemroot%\system32\sc.exe start osppsvc
C:\Windows\system32\tasks\Microsoft\Windows\WindowsBackup\ConfigNotification - %systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
C:\Windows\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\Windows\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\Windows\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -queuereporting
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask - %SystemRoot%\system32\Wat\WatAdminSvc.exe /run
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline - %SystemRoot%\system32\schtasks.exe /run /I /TN "\Microsoft\Windows\Windows Activation Technologies\ValidationTask"
C:\Windows\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\Windows\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
C:\Windows\system32\tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask - sc.exe start sppsvc
C:\Windows\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\Windows\system32\tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem - %SystemRoot%\System32\powercfg.exe -energy -auto
C:\Windows\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\Windows\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService - %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks - %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ehDRMInit - %SystemRoot%\ehome\ehPrivJob.exe /DRMInit
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\InstallPlayReady - %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\mcupdate - %SystemRoot%\ehome\mcupdate $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURActivate - %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURDiscovery - %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscovery - %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 - %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 - %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PeriodicScanRetry - %windir%\ehome\MCUpdate.exe -pscn 0
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrScheduleTask - %SystemRoot%\ehome\mcupdate.exe -PvrSchedule
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RecordingRestart - %SystemRoot%\ehome\ehrec /RestartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RegisterSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ReindexSearchRoot - %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\StartRecording - %SystemRoot%\ehome\ehrec /StartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\UpdateRecordPath - %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotifications.exe
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\Windows\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\Windows\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\AitAgent - aitagent
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattel\DiagTrackRunner.exe /UploadEtlFilesOnly
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\Windows\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\Windows\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe
C:\Windows\system32\tasks\Microsoft\Office\Office 15 Subscription Heartbeat - %ProgramFiles%\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
C:\Windows\system32\tasks\Microsoft\Office\OfficeTelemetryAgentFallBack - "C:\Program Files\Microsoft Office\Office15\msoia.exe" scan upload mininterval:2880
C:\Windows\system32\tasks\Microsoft\Office\OfficeTelemetryAgentLogOn - "C:\Program Files\Microsoft Office\Office15\msoia.exe" scan upload
C:\Windows\system32\tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan - c:\Program Files\Microsoft Security Client\\MpCmdRun.exe Scan -ScheduleJob -RestrictPrivileges
C:\Windows\system32\tasks\Lenovo\Lenovo Customer Feedback Program 64 - "%ProgramFiles(x86)%\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe"
C:\Windows\system32\tasks\Lenovo\Lenovo Customer Feedback Program 64 35 - "%ProgramFiles(x86)%\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe"
C:\Windows\system32\tasks\Lenovo\Message Center Plus Launcher - "%programfiles(x86)%\Lenovo\message center plus\mcplaunch.exe" /start
C:\Windows\system32\tasks\AVAST Software\Avast settings backup - C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe /backup /iavs

=========Mozilla firefox=========

ProfilePath - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.148 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_148.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\SysWOW64\Adobe\Director\np32dsw_1224194.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]
"Description"=This plugin updates Intel WebAPI component
"Path"=C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.131.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.131.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_131\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/Lync,version=15.0]
"Description"=Microsoft Lync Plug-in for Firefox
"Path"=C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nokia.com/EnablerPlugin]
"Description"=Nokia Suite Enabler Plugin
"Path"=C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.148 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_148.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.131.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.131.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre1.8.0_131\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.2.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll


C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default\addons.json
Mozilla Firefox hotfix - extension - firefox-hotfix@mozilla.org

C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default\extensions.json
Shield Recipe Client - extension - shield-recipe-client@mozilla.org - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default\features\{187b514d-40fc-4cfb-8bf4-69841788027a}\shield-recipe-client@mozilla.org.xpi
Application Update Service Helper - extension - aushelper@mozilla.org - C:\Program Files (x86)\Mozilla Firefox\browser\features\aushelper@mozilla.org.xpi
Multi-process staged rollout - extension - e10srollout@mozilla.org - C:\Program Files (x86)\Mozilla Firefox\browser\features\e10srollout@mozilla.org.xpi
Pocket - extension - firefox@getpocket.com - C:\Program Files (x86)\Mozilla Firefox\browser\features\firefox@getpocket.com.xpi
Web Compat - extension - webcompat@mozilla.org - C:\Program Files (x86)\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi
Default - theme - {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi

C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default\pluginreg.dat
Plugin - Shockwave Flash - 25.0.0.148 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_148.dll

=========Google Chrome=========

C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Extension aapocclcgogkmnckokdopfmhonfmgoek 1 Prezentace Google 0.9
Extension ahfgeienlihckogmohjhadlkjgocpleb 1 Obchod Chrome 0.2
Extension aohghmighlieiainnegkcijnfilokake 1 Dokumenty Google 0.9
Extension apdfllckaahabafndbhieahigkjlhalf 1 Disk Google 14.1
Extension bepbmhgboaologfdajaanbcjmnhjmhfn 0
Extension bgjpfhpjcgdppjbgnpnjllokbmcdllig 1 Seznam Lištička - Email 1.4.2
Extension blmojkbhnkkphngknkmgccmlenfaelkd 1 Seznam Lištička - Slovník 1.4.6
Extension blpcfgokakmgnkcojhhkbfbldkacnbeo 1 YouTube 4.2.8
Extension eemcgdkfndhakfknompkggombfjjjeno 1 Bookmark Manager 0.1
Extension ennkphjdgehloodpbhlhldgbnhmacadg 1 Settings 0.2
Extension eofcbnmajmjmplflapaojjnihcjkigck 2 Avast SafePrice 11.1.0.221
Extension felcaaldnbdncclmgdcncolpebgiejap 1 Tabulky Google 1.1
Extension fngmhnnpilhplaeedifhccceomclgfbg 1 Tables 78.0
Extension gfdkimpbcpahaombhbimeihdjnejgicl 1 Feedback 1.0
Extension ghbmnnjooekpmoecnnnilnnbdlolhkhi 1 Dokumenty Google offline 1.4
Extension gighmmpiobklfepjocnamgkkbiglidom 1 AdBlock 3.10.0
Extension kmendfapggjehodndflmmgagdbamhnfd 1 CryptoTokenExtension 0.9.46
Extension mfehgcgbbipciphmccgaenjidiccnmng 1 Cloud Print 0.1
Extension mfffpogegjflfpflabcdkioaeobkgjik 1 GaiaAuthExtension 0.0.1
Extension mgndgikekgjfcpckkfioiadnlibdjbkf 1 Chrome 0.1
Extension mhjfbmdgcfjbbpaeojofohoefgiehjai 1 Chrome PDF Viewer 1
Extension neajdppkdcdipfabeoofebfddakdcjhd 1 Google Network Speech 1.0
Extension nkeimhogjdpnpccoofpliimaahmaaome 1 Google Hangouts 1.3.2
Extension nmmhkkegccagdldgiimedpiccmgmieda 1 Platby Internetového obchodu Chrome 1.0.0.2
Extension olfeabkoenfaoljndfecamgilllcpiak 0 Seznam Lištička - Rychlá volba 1.9.1
Extension pjkljhegncpnkpknbcohdijeoejaedia 1 Gmail 8.1
Extension pkedcjkdefgpdelpbcmbmeomcjbeemfm 1 Chrome Media Router 5817.313.0.3
Homepage:
default_search_provider.search_url:
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Preferences
Homepage:
default_search_provider.search_url:

======Registry dump ======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2017-03-14 229064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_131\bin\ssv.dll [2017-04-24 571456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-04-24 234560]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll [2017-04-24 473152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL [2017-02-23 1743664]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-04-24 186944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SAIICpl.exe [2009-11-15 307768]
"LENOVO.TPKNRRES"=C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [2013-05-29 60920]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2016-03-02 183216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2016-03-02 411056]
"Persistence"=C:\Windows\system32\igfxpers.exe [2016-03-02 453544]
"CDAServer"=C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [2014-09-08 464608]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2016-11-14 1353680]
"Malwarebytes TrayApp"=C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2017-01-20 2780112]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2017-03-14 27545048]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"PWMTRV"=rundll32 C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL,PwrMgrBkGndMonitor []
"IMSS"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [2013-07-02 113656]
"RotateImage"=C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [2008-10-30 55808]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2017-03-15 587288]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
Digital Line Detect.lnk - C:\Program Files (x86)\Digital Line Detect\DLG.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\System32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2016-03-02 451584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages" = scecli
C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableCAD"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"StubPath" = "C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.96\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux1"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"wave9"=wdmaud.drv
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv
"aux3"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

====== File associations ======

.ini - open - "%SystemRoot%\system32\NOTEPAD.EXE" %1
.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - "%SystemRoot%\system32\NOTEPAD.EXE" %1

====== List of files/folders created in the last 1 month ======

2017-05-08 11:47:04 ----A---- C:\Windows\system32\FNTCACHE.DAT
2017-05-08 11:41:15 ----D---- C:\AdwCleaner
2017-05-08 11:22:44 ----D---- C:\rsit
2017-05-08 11:22:44 ----D---- C:\Program Files\trend micro
2017-05-08 11:10:01 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2017-05-08 11:09:56 ----D---- C:\Program Files\Mozilla Firefox
2017-05-08 10:54:54 ----SHD---- C:\$RECYCLE.BIN
2017-05-08 10:54:47 ----D---- C:\Windows\temp
2017-05-08 10:54:45 ----A---- C:\ComboFix.txt
2017-05-08 10:41:23 ----A---- C:\Windows\zip.exe
2017-05-08 10:41:23 ----A---- C:\Windows\SWSC.exe
2017-05-08 10:41:23 ----A---- C:\Windows\SWREG.exe
2017-05-08 10:41:23 ----A---- C:\Windows\sed.exe
2017-05-08 10:41:23 ----A---- C:\Windows\PEV.exe
2017-05-08 10:41:23 ----A---- C:\Windows\NIRCMD.exe
2017-05-08 10:41:23 ----A---- C:\Windows\MBR.exe
2017-05-08 10:41:23 ----A---- C:\Windows\grep.exe
2017-05-08 10:39:50 ----D---- C:\Qoobox
2017-05-08 10:39:28 ----D---- C:\Windows\erdnt
2017-05-07 21:15:19 ----D---- C:\Users\PC\AppData\Roaming\Mozilla
2017-05-07 20:54:07 ----A---- C:\Windows\system32\drivers\MBAMChameleon.sys
2017-05-07 20:54:06 ----A---- C:\Windows\system32\drivers\mwac.sys
2017-05-07 20:54:06 ----A---- C:\Windows\system32\drivers\farflt.sys
2017-05-07 20:54:03 ----A---- C:\Windows\system32\drivers\mbam.sys
2017-05-07 20:53:30 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2017-05-07 20:53:18 ----A---- C:\Windows\system32\drivers\mbae64.sys
2017-05-07 20:53:11 ----D---- C:\ProgramData\Malwarebytes
2017-05-07 20:53:11 ----D---- C:\Program Files\Malwarebytes
2017-05-07 19:52:04 ----D---- C:\Program Files (x86)\MozBackup
2017-05-06 19:06:24 ----D---- C:\Program Files\Common Files\adaware
2017-05-06 19:05:40 ----D---- C:\ProgramData\Lavasoft
2017-05-06 15:11:25 ----D---- C:\ProgramData\Spybot - Search & Destroy
2017-05-06 15:11:08 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-05-06 14:40:46 ----D---- C:\Program Files\61GIPRPJJP
2017-05-06 14:35:51 ----D---- C:\ProgramData\{B58DB328-0226-0483-C45B-94C93C8C56C3}
2017-05-06 14:34:24 ----D---- C:\Program Files\ID6PRZNMNG
2017-05-06 14:34:18 ----D---- C:\Program Files\B8U9ZQ4633
2017-05-06 14:34:12 ----D---- C:\Program Files\I091IWDH8V
2017-04-24 22:13:26 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-64.dll
2017-04-12 21:41:51 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2017-04-12 21:41:51 ----A---- C:\Windows\system32\rdpcorets.dll
2017-04-12 21:41:50 ----A---- C:\Windows\system32\mshtml.dll
2017-04-12 21:41:49 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-04-12 21:41:48 ----A---- C:\Windows\system32\ieframe.dll
2017-04-12 21:41:46 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-04-12 21:41:45 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-04-12 21:41:45 ----A---- C:\Windows\system32\wininet.dll
2017-04-12 21:41:44 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-04-12 21:41:44 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\wuaueng.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\win32k.sys
2017-04-12 21:41:44 ----A---- C:\Windows\system32\urlmon.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\ole32.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\iertutil.dll
2017-04-12 21:41:43 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-04-12 21:41:43 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\wucltux.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\wuapi.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\win32spl.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\samsrv.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\ucrtbase.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\quartz.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\msfeeds.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\cdosys.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\atmfd.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\quartz.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2017-04-12 21:41:41 ----A---- C:\Windows\system32\gdi32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\ucrtbase.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\iedkcs32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l2-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\jscript.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-12 21:41:38 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-04-12 21:41:38 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-04-12 21:41:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-04-12 21:41:36 ----A---- C:\Windows\system32\ntdll.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\mfmjpegdec.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\asycfilt.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\webcheck.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\samlib.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\mfmjpegdec.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\jscript9.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-04-12 21:41:35 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-04-12 21:41:35 ----A---- C:\Windows\system32\asycfilt.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\samlib.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\cdosys.dll
2017-04-12 21:41:34 ----A---- C:\Windows\system32\rdpudd.dll
2017-04-12 21:41:34 ----A---- C:\Windows\system32\ie4uinit.exe
2017-04-12 21:41:34 ----A---- C:\Windows\system32\certcli.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\wups.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wuwebv.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wups2.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wups.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wudriver.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\vbscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\srcore.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\rpcrt4.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\ieapfltr.dll
2017-04-12 21:41:32 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2017-04-12 21:41:32 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\wuauclt.exe
2017-04-12 21:41:32 ----A---- C:\Windows\system32\lsasrv.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\ieui.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\dxtrans.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\dxtmsft.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-04-12 21:41:31 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\srclient.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\smss.exe
2017-04-12 21:41:31 ----A---- C:\Windows\system32\msrating.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\mshtmled.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\kerberos.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\advapi32.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\WinSetupUI.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\rstrui.exe
2017-04-12 21:41:30 ----A---- C:\Windows\system32\occache.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\kernel32.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\jscript9diag.dll
2017-04-12 21:41:29 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\schannel.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-12 21:41:29 ----A---- C:\Windows\system32\jsproxy.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\ieUnatt.exe
2017-04-12 21:41:29 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-04-12 21:41:29 ----A---- C:\Windows\system32\conhost.exe
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\wow64win.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\winsrv.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\ncrypt.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\msv1_0.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\KernelBase.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\inseng.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\wuapp.exe
2017-04-12 21:41:27 ----A---- C:\Windows\system32\wdigest.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\TSpkg.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\sspicli.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\iesetup.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\wow64.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\rpchttp.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\iernonce.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-04-12 21:41:26 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-04-12 21:41:26 ----A---- C:\Windows\system32\csrsrv.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\cdd.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\bcrypt.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-04-12 21:41:25 ----A---- C:\Windows\system32\drivers\appid.sys
2017-04-12 21:41:25 ----A---- C:\Windows\system32\cryptbase.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\wow64cpu.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\sspisrv.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\lsass.exe
2017-04-12 21:41:24 ----A---- C:\Windows\system32\lpk.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\secur32.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\fontsub.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\dciman32.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\appidsvc.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\appidapi.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\lpk.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\ntvdm64.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\credssp.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\auditpol.exe
2017-04-12 21:41:22 ----A---- C:\Windows\system32\atmlib.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-04-12 21:41:22 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\user.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\tzres.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\tzres.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\msaudite.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\apisetschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\adtschema.dll
2017-04-12 21:41:19 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-04-12 21:41:19 ----A---- C:\Windows\system32\msobjs.dll
2017-04-12 21:41:19 ----A---- C:\Windows\system32\ieetwcollectorres.dll

====== List of files/folders modified in the last 1 month ======

2017-05-08 12:06:26 ----D---- C:\Windows\system32\config
2017-05-08 11:49:36 ----A---- C:\Windows\SYSWOW64\log.txt
2017-05-08 11:48:55 ----D---- C:\Users\PC\AppData\Roaming\Skype
2017-05-08 11:48:22 ----D---- C:\Windows\system32\drivers
2017-05-08 11:48:11 ----D---- C:\Windows\inf
2017-05-08 11:47:18 ----D---- C:\Windows
2017-05-08 11:47:04 ----D---- C:\Windows\System32
2017-05-08 11:46:34 ----D---- C:\Program Files (x86)\TeamViewer
2017-05-08 11:22:44 ----RD---- C:\Program Files
2017-05-08 11:10:01 ----RD---- C:\Program Files (x86)
2017-05-08 11:02:16 ----D---- C:\Program Files (x86)\Mozilla Firefox
2017-05-08 10:50:58 ----A---- C:\Windows\system.ini
2017-05-08 10:50:47 ----D---- C:\Windows\system32\drivers\etc
2017-05-08 10:50:06 ----D---- C:\Windows\SysWOW64
2017-05-08 10:48:28 ----D---- C:\Windows\Prefetch
2017-05-08 10:46:50 ----D---- C:\Windows\SYSWOW64\drivers
2017-05-08 10:46:50 ----D---- C:\Windows\AppPatch
2017-05-08 10:46:49 ----D---- C:\Program Files (x86)\Common Files
2017-05-08 10:35:18 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-05-07 20:53:11 ----D---- C:\ProgramData
2017-05-07 20:50:25 ----SHD---- C:\Windows\Installer
2017-05-07 20:46:01 ----D---- C:\Program Files (x86)\Google
2017-05-07 20:45:22 ----D---- C:\Windows\system32\Tasks
2017-05-07 17:44:57 ----SHD---- C:\System Volume Information
2017-05-07 17:18:40 ----D---- C:\Windows\Tasks
2017-05-07 16:46:45 ----RSD---- C:\Windows\Fonts
2017-05-07 16:46:44 ----D---- C:\Users\PC\AppData\Roaming\TeamViewer
2017-05-07 08:23:43 ----SD---- C:\ProgramData\Microsoft
2017-05-06 19:06:24 ----D---- C:\Program Files\Common Files
2017-05-06 15:30:17 ----D---- C:\Program Files\Common Files\AV
2017-05-06 15:03:48 ----D---- C:\Windows\Panther
2017-05-06 15:03:47 ----D---- C:\Windows\Logs
2017-05-06 15:03:46 ----D---- C:\Windows\Minidump
2017-05-06 15:03:46 ----D---- C:\Windows\debug
2017-05-06 13:25:29 ----D---- C:\ProgramData\Microsoft Help
2017-05-06 13:24:45 ----RSD---- C:\Windows\assembly
2017-05-01 19:32:10 ----D---- C:\Windows\system32\catroot2
2017-04-24 23:40:45 ----D---- C:\ProgramData\Oracle
2017-04-24 22:13:39 ----D---- C:\Program Files (x86)\Java
2017-04-24 22:13:23 ----D---- C:\Program Files\Java
2017-04-24 22:12:24 ----A---- C:\Windows\system32\WindowsAccessBridge-64.dll
2017-04-24 22:11:19 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2017-04-13 19:12:15 ----D---- C:\Windows\LiveKernelReports
2017-04-13 08:08:55 ----D---- C:\Windows\rescache
2017-04-13 07:29:53 ----D---- C:\Windows\winsxs
2017-04-13 07:26:53 ----D---- C:\Windows\SYSWOW64\en-US
2017-04-13 07:26:53 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-04-13 07:26:53 ----D---- C:\Program Files\Internet Explorer
2017-04-13 07:26:51 ----D---- C:\Windows\system32\en-US
2017-04-13 07:26:51 ----D---- C:\Windows\system32\cs-CZ
2017-04-13 07:26:50 ----D---- C:\Windows\system32\Boot
2017-04-13 07:26:50 ----D---- C:\Program Files (x86)\Internet Explorer
2017-04-13 07:08:33 ----D---- C:\Program Files\Microsoft Silverlight
2017-04-13 07:08:33 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2017-04-13 07:07:25 ----D---- C:\Windows\Microsoft.NET
2017-04-13 07:06:53 ----D---- C:\Windows\system32\MRT
2017-04-13 06:57:53 ----AC---- C:\Windows\system32\MRT.exe
2017-04-13 06:53:01 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-04-12 07:43:58 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2017-04-12 07:43:52 ----D---- C:\Windows\system32\Macromed
2017-04-12 07:43:50 ----D---- C:\Windows\SYSWOW64\Macromed

File C:\Windows\system32\winlogon.exe is digitally signed
File C:\Windows\system32\wininit.exe is digitally signed
File C:\Windows\explorer.exe is digitally signed
File C:\Windows\SysWOW64\explorer.exe is digitally signed
File C:\Windows\system32\svchost.exe is digitally signed
File C:\Windows\SysWOW64\svchost.exe is digitally signed
File C:\Windows\system32\services.exe is digitally signed
File C:\Windows\system32\User32.dll is digitally signed
File C:\Windows\SysWOW64\User32.dll is digitally signed
File C:\Windows\system32\userinit.exe is digitally signed
File C:\Windows\SysWOW64\userinit.exe is digitally signed
File C:\Windows\system32\rpcss.dll is digitally signed
File C:\Windows\system32\Drivers\volsnap.sys is digitally signed

====== List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R0 DzHDD64;DzHDD64; C:\Windows\System32\DRIVERS\DzHDD64.sys [2016-04-14 29512]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2012-05-30 569152]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2016-08-25 295000]
R0 nvpciflt;nvpciflt; C:\Windows\system32\DRIVERS\nvpciflt.sys [2013-10-29 30496]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 ESProtectionDriver;Malwarebytes Anti-Exploit; \??\C:\Windows\system32\drivers\mbae64.sys [2017-03-22 77440]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiifx64.sys [2013-05-22 15472]
R1 nvkflt;nvkflt; C:\Windows\system32\DRIVERS\nvkflt.sys [2013-10-29 284448]
R1 TPPWRIF;TPPWRIF; C:\Windows\System32\drivers\Tppwr64v.sys [2016-04-14 29008]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 MBAMChameleon;MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [2017-05-07 186304]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 17024]
R2 risdxc;risdxc; C:\Windows\system32\DRIVERS\risdxc64.sys [2011-05-25 101888]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2014-05-07 11576]
R3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2011-03-04 166016]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 btwampfl;btwampfl Bluetooth filter driver; \??\C:\Windows\system32\drivers\btwampfl.sys [2012-12-04 598808]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2012-05-02 184144]
R3 btwavdt;Bluetooth AVDT; C:\Windows\system32\DRIVERS\btwavdt.sys [2012-03-06 210984]
R3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2011-09-18 39976]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2012-03-06 21544]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2012-06-04 1580704]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2015-10-29 506880]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2016-09-06 82232]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2016-03-02 5384728]
R3 MBAMFarflt;MBAMFarflt; \??\C:\Windows\system32\drivers\farflt.sys [2017-05-08 111544]
R3 MBAMProtection;MBAMProtection; \??\C:\Windows\system32\drivers\mbam.sys [2017-05-08 43968]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2017-05-08 251832]
R3 MBAMWebProtection;MBAMWebProtection; \??\C:\Windows\system32\drivers\mwac.sys [2017-05-08 82720]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2012-11-09 57376]
R3 NETw5s64;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2016-08-25 135928]
R3 psadd;Lenovo Parties Service Access Device Driver; C:\Windows\system32\DRIVERS\psadd.sys [2009-12-08 37440]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RtlvVga;RtlvVga; C:\Windows\system32\DRIVERS\RtlvVga.sys [2014-03-18 11920]
R3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2014-07-28 45296]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-14 12288]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2014-07-28 461552]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmpx64.sys [2009-09-03 67072]
S2 rimspci;rimspci; C:\Windows\system32\DRIVERS\rimspe64.sys [2009-10-26 61952]
S2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimspx64.sys [2009-09-03 54784]
S2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdpx64.sys [2009-09-03 57856]
S3 ATSwpWDF;AuthenTec TruePrint USB Driver; C:\Windows\System32\Drivers\ATSwpWDF.sys [2010-02-05 736840]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 btusbflt;Bluetooth USB Filter; C:\Windows\system32\drivers\btusbflt.sys [2010-04-09 54824]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CAXHWAZL;CAXHWAZL; C:\Windows\system32\DRIVERS\CAXHWAZL.sys [2009-06-30 292864]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K; C:\Windows\system32\DRIVERS\e1k62x64.sys [2011-07-20 342704]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver; C:\Windows\system32\DRIVERS\e1y62x64.sys [2010-04-07 290008]
S3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2012-11-09 57376]
S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\CAX_DPV.sys [2009-06-30 1486848]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2013-01-23 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2013-01-23 27136]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2013-02-25 194848]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2012-10-17 26112]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter; C:\Windows\system32\DRIVERS\rtwlane.sys [2015-01-06 3709656]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-21 109056]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2013-01-23 9216]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 usbser;USB Modem Driver; C:\Windows\system32\DRIVERS\usbser.sys [2013-08-29 33280]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2013-01-23 9216]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]

====== List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-04-25 83056]
R2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe [2013-05-14 1008344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\cscsvc.dll
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; %SystemRoot%\System32\svchost.exe -k utcsvc;"ServiceDll" = %SystemRoot%\system32\diagtrack.dll
R2 HsfXAudioService;HsfXAudioService; %SystemRoot%\system32\svchost.exe -k HsfXAudioService;"ServiceDll" = C:\Windows\SysWOW64\XAudio64.dll
R2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2016-09-06 180736]
R2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service; C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [2014-07-09 214464]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute; C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [2013-05-29 44024]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-05-27 110128]
R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction; C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2013-05-29 62456]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-07-02 327672]
R2 MBAMService;Malwarebytes Service; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [2017-01-20 4355024]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2016-11-14 119864]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-10-29 893216]
R2 SamsungUPDUtilSvc;Samsung UPD Utility Service; C:\Windows\SysWOW64\SecUPDUtilSvc.exe [2016-05-22 143664]
R2 TeamViewer;TeamViewer 12; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2017-04-25 10888944]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 125424]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2014-05-27 125488]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2013-07-02 2595832]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2016-11-14 361816]
R3 Power Manager DBC Service;Power Manager Service; C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2016-04-14 1668776]
R3 SUService;System Update; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [2017-01-18 23416]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-03-20 105096]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-03-20 125064]
S2 gupdate;Služba Aktualizace Google (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-07 153168]
S2 LPlatSvc;Lenovo Platform Service; C:\Windows\system32\LPlatSvc.exe [2016-09-06 710144]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2017-01-16 317400]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-12 271448]
S3 AppMgmt;@appmgmts.dll,-3250; %SystemRoot%\system32\svchost.exe -k netsvcs;"ServiceDll" = %SystemRoot%\System32\appmgmts.dll
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2016-03-02 290224]
S3 DozeSvc;Lenovo Doze Mode Service; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2016-04-14 326160]
S3 gupdatem;Služba Aktualizace Google (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-07 153168]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-03-25 114688]
S3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [2014-12-05 619776]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-05-04 191944]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-12-08 178760]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 5132888]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; %SystemRoot%\System32\svchost.exe -k PeerDist;"ServiceDll" = %SystemRoot%\system32\peerdistsvc.dll
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2013-04-18 737616]
S3 ShareItSvc;ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [2016-01-20 31176]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\system32\storsvc.dll
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\umrdp.dll
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-03-20 51320]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]

-----------------EOF-----------------

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:

:files
C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore
C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]/64
[-HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]/64
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-

:commands
[Purity]
[Emptytemp]
[Emptyflash]

a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.

Logfile of random's system information tool 1.16 (written by random/random)
Run by PC at 2017-05-08 18:19:38
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 228 GB (75%) free of 305 GB
Total RAM: 3871 MB (48% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:19:56, on 8.5.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18639)
Boot mode: Normal

Running processes:
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
C:\Program Files\ThinkPad\Bluetooth Software\Bluetooth Headset Helper.exe
C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe
C:\Program Files\trend micro\PC_RSITx64.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.cz/?gfe_rd=cr&ei=_f8 ... =ssl#spf=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll
O4 - HKLM\..\Run: [PWMTRV] rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [IMSS] "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [RotateImage] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files (x86)\Digital Line Detect\DLG.exe
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{188F5398-8881-43B3-ADA8-B61A7DFF6BE0}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{1EDAEE71-673D-4DF0-9D04-E2034A310C93}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{202E7AAF-2584-40D3-9169-60B6DAD619DF}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{29AF921B-5F20-4AAE-9A4A-BCA5F2DEF44D}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{30D86D8B-2C59-46E0-8B60-06DA6DF1E266}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{3348A0D7-4558-491F-81CE-7C6F110DA21E}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A20815E-01EC-4BD4-9EF8-9234B1B147ED}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{605F2096-7325-42DB-A22C-13C053B03D20}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{846ee342-7039-11de-9d20-806e6f6e6963}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A17FC28-21DF-45A4-98FA-0AED85926008}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{A23611C8-B1EA-4076-8E53-64E7149BF592}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{FFBE0C14-C8BE-48E3-84B4-DE53BB435A57}: NameServer = 8.8.8.8
O17 - HKLM\System\CS1\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O17 - HKLM\System\CS2\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Identity Protection Technology Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo EasyPlus Hotspot - Lenovo - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Lenovo Platform Service (LPlatSvc) - Unknown owner - C:\Windows\system32\LPlatSvc.exe (file missing)
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: Power Manager Service (Power Manager DBC Service) - Lenovo - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Samsung UPD Utility Service (SamsungUPDUtilSvc) - Unknown owner - C:\Windows\SysWOW64\SecUPDUtilSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ShareItSvc - SHAREit Technologies Co.Ltd - C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files (x86)\Lenovo\System Update\SUService.exe
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11199 bytes

====== Enumerating Processes ======

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\winlogon.exe
C:\Windows\system32\ibmpmsvc.exe
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
C:\Windows\system32\svchost.exe -k HsfXAudioService
"C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe"
"C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe"
"C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe"
C:\Windows\SysWOW64\SecUPDUtilSvc.exe
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
"c:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\rundll32.exe "C:\Program Files\LENOVO\HOTKEY\hotkey.dll",InstallAudioHotkeyHook
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.FullScreenMagnifier
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
"C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"c:\program files (x86)\teamviewer\TeamViewer_Desktop.exe" --IPCport 5939
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
"C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe"
C:\Windows\SysWOW64\rundll32.exe
"C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Lenovo\System Update\SUService.exe"
"C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe"
"C:\Windows\SysWOW64\RunDll32.exe" "C:\Program Files\ThinkPad\Bluetooth Software\SysWOW64\BtMmHook.dll",SetAndWaitBtMmHook
"C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe" -Embedding
"C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe" -Embedding
"C:\Program Files\ThinkPad\Bluetooth Software\Bluetooth Headset Helper.exe"
"C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe" /start
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Users\PC\Desktop\RSITx64.exe"

====== Scheduled tasks folder ======

C:\Windows\system32\tasks\Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\system32\tasks\Adobe Flash Player Updater - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\system32\tasks\klcp_update - "C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe" /verysilent /update /freq=30
C:\Windows\system32\tasks\PMTask - C:\Program Files (x86)\ThinkPad\Utilities\PwmIdTsv.exe
C:\Windows\system32\tasks\SidebarExecute - C:\Program Files (x86)\Windows Sidebar\sidebar.exe /showGadgets
C:\Windows\system32\tasks\Synaptics TouchPad Enhancements - \Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\tasks\{0D1AEFEE-2309-F090-AF3D-12B63B9FF166} - C:\Windows\system32\regsvr32.exe /s /n /i:"/rt" "C:\PROGRA~3\207d4732\768720c1.dll"
C:\Windows\system32\tasks\{87EB3D5C-6FA0-4A1D-83AA-B32F937AD1B7} - "c:\program files (x86)\mozilla firefox\firefox.exe" http://ui.skype.com/ui/0/7.23.0.105/cs/ ... =tsInstall
C:\Windows\system32\tasks\WPD\SqmUpload_S-1-5-21-1790732064-3310509644-602799907-1000 - %windir%\system32\rundll32.exe portabledeviceapi.dll,#1
C:\Windows\system32\tasks\TVT\TVSUUpdateTask - "C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe" /CM -search C -action INSTALL -includerebootpackages 1,3,4 -noicon -noreboot -nolicense -defaultupdate -schtask
C:\Windows\system32\tasks\TVT\TVSUUpdateTask_UserLogOn - "C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe" PendingTask
C:\Windows\system32\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask - %systemroot%\system32\sc.exe start osppsvc
C:\Windows\system32\tasks\Microsoft\Windows\WindowsBackup\ConfigNotification - %systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
C:\Windows\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\Windows\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\Windows\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -queuereporting
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask - %SystemRoot%\system32\Wat\WatAdminSvc.exe /run
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline - %SystemRoot%\system32\schtasks.exe /run /I /TN "\Microsoft\Windows\Windows Activation Technologies\ValidationTask"
C:\Windows\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\Windows\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
C:\Windows\system32\tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask - sc.exe start sppsvc
C:\Windows\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\Windows\system32\tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem - %SystemRoot%\System32\powercfg.exe -energy -auto
C:\Windows\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\Windows\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService - %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks - %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ehDRMInit - %SystemRoot%\ehome\ehPrivJob.exe /DRMInit
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\InstallPlayReady - %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\mcupdate - %SystemRoot%\ehome\mcupdate $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURActivate - %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURDiscovery - %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscovery - %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 - %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 - %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PeriodicScanRetry - %windir%\ehome\MCUpdate.exe -pscn 0
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrScheduleTask - %SystemRoot%\ehome\mcupdate.exe -PvrSchedule
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RecordingRestart - %SystemRoot%\ehome\ehrec /RestartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RegisterSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ReindexSearchRoot - %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\StartRecording - %SystemRoot%\ehome\ehrec /StartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\UpdateRecordPath - %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotifications.exe
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\Windows\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\Windows\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\AitAgent - aitagent
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattel\DiagTrackRunner.exe /UploadEtlFilesOnly
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\Windows\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\Windows\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe
C:\Windows\system32\tasks\Microsoft\Office\Office 15 Subscription Heartbeat - %ProgramFiles%\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
C:\Windows\system32\tasks\Microsoft\Office\OfficeTelemetryAgentFallBack - "C:\Program Files\Microsoft Office\Office15\msoia.exe" scan upload mininterval:2880
C:\Windows\system32\tasks\Microsoft\Office\OfficeTelemetryAgentLogOn - "C:\Program Files\Microsoft Office\Office15\msoia.exe" scan upload
C:\Windows\system32\tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan - c:\Program Files\Microsoft Security Client\\MpCmdRun.exe Scan -ScheduleJob -RestrictPrivileges
C:\Windows\system32\tasks\Lenovo\Lenovo Customer Feedback Program 64 - "%ProgramFiles(x86)%\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe"
C:\Windows\system32\tasks\Lenovo\Lenovo Customer Feedback Program 64 35 - "%ProgramFiles(x86)%\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe"
C:\Windows\system32\tasks\Lenovo\Message Center Plus Launcher - "%programfiles(x86)%\Lenovo\message center plus\mcplaunch.exe" /start
C:\Windows\system32\tasks\AVAST Software\Avast settings backup - C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe /backup /iavs

=========Mozilla firefox=========

ProfilePath - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.148 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_148.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\SysWOW64\Adobe\Director\np32dsw_1224194.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]
"Description"=This plugin updates Intel WebAPI component
"Path"=C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.131.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.131.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_131\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/Lync,version=15.0]
"Description"=Microsoft Lync Plug-in for Firefox
"Path"=C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nokia.com/EnablerPlugin]
"Description"=Nokia Suite Enabler Plugin
"Path"=C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.148 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_148.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.131.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.131.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre1.8.0_131\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.2.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll


C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default\addons.json
Mozilla Firefox hotfix - extension - firefox-hotfix@mozilla.org

C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default\extensions.json
Shield Recipe Client - extension - shield-recipe-client@mozilla.org - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default\features\{187b514d-40fc-4cfb-8bf4-69841788027a}\shield-recipe-client@mozilla.org.xpi
Application Update Service Helper - extension - aushelper@mozilla.org - C:\Program Files (x86)\Mozilla Firefox\browser\features\aushelper@mozilla.org.xpi
Multi-process staged rollout - extension - e10srollout@mozilla.org - C:\Program Files (x86)\Mozilla Firefox\browser\features\e10srollout@mozilla.org.xpi
Pocket - extension - firefox@getpocket.com - C:\Program Files (x86)\Mozilla Firefox\browser\features\firefox@getpocket.com.xpi
Web Compat - extension - webcompat@mozilla.org - C:\Program Files (x86)\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi
Default - theme - {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi

C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\tpn5t8ls.default\pluginreg.dat
Plugin - Shockwave Flash - 25.0.0.148 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_148.dll

=========Google Chrome=========

C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Extension aapocclcgogkmnckokdopfmhonfmgoek 1 Prezentace Google 0.9
Extension ahfgeienlihckogmohjhadlkjgocpleb 1 Obchod Chrome 0.2
Extension aohghmighlieiainnegkcijnfilokake 1 Dokumenty Google 0.9
Extension apdfllckaahabafndbhieahigkjlhalf 1 Disk Google 14.1
Extension bepbmhgboaologfdajaanbcjmnhjmhfn 0
Extension bgjpfhpjcgdppjbgnpnjllokbmcdllig 1 Seznam Lištička - Email 1.4.2
Extension blmojkbhnkkphngknkmgccmlenfaelkd 1 Seznam Lištička - Slovník 1.4.6
Extension blpcfgokakmgnkcojhhkbfbldkacnbeo 1 YouTube 4.2.8
Extension eemcgdkfndhakfknompkggombfjjjeno 1 Bookmark Manager 0.1
Extension ennkphjdgehloodpbhlhldgbnhmacadg 1 Settings 0.2
Extension eofcbnmajmjmplflapaojjnihcjkigck 2 Avast SafePrice 11.1.0.221
Extension felcaaldnbdncclmgdcncolpebgiejap 1 Tabulky Google 1.1
Extension fngmhnnpilhplaeedifhccceomclgfbg 1 Tables 78.0
Extension gfdkimpbcpahaombhbimeihdjnejgicl 1 Feedback 1.0
Extension ghbmnnjooekpmoecnnnilnnbdlolhkhi 1 Dokumenty Google offline 1.4
Extension gighmmpiobklfepjocnamgkkbiglidom 1 AdBlock 3.10.0
Extension kmendfapggjehodndflmmgagdbamhnfd 1 CryptoTokenExtension 0.9.46
Extension mfehgcgbbipciphmccgaenjidiccnmng 1 Cloud Print 0.1
Extension mfffpogegjflfpflabcdkioaeobkgjik 1 GaiaAuthExtension 0.0.1
Extension mgndgikekgjfcpckkfioiadnlibdjbkf 1 Chrome 0.1
Extension mhjfbmdgcfjbbpaeojofohoefgiehjai 1 Chrome PDF Viewer 1
Extension neajdppkdcdipfabeoofebfddakdcjhd 1 Google Network Speech 1.0
Extension nkeimhogjdpnpccoofpliimaahmaaome 1 Google Hangouts 1.3.2
Extension nmmhkkegccagdldgiimedpiccmgmieda 1 Platby Internetového obchodu Chrome 1.0.0.2
Extension olfeabkoenfaoljndfecamgilllcpiak 0 Seznam Lištička - Rychlá volba 1.9.1
Extension pjkljhegncpnkpknbcohdijeoejaedia 1 Gmail 8.1
Extension pkedcjkdefgpdelpbcmbmeomcjbeemfm 1 Chrome Media Router 5817.313.0.3
Homepage:
default_search_provider.search_url:
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Preferences
Homepage:
default_search_provider.search_url:

======Registry dump ======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2017-03-14 229064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_131\bin\ssv.dll [2017-04-24 571456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-04-24 234560]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll [2017-04-24 473152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL [2017-02-23 1743664]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-04-24 186944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SAIICpl.exe [2009-11-15 307768]
"LENOVO.TPKNRRES"=C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [2013-05-29 60920]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2016-03-02 183216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2016-03-02 411056]
"Persistence"=C:\Windows\system32\igfxpers.exe [2016-03-02 453544]
"CDAServer"=C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [2014-09-08 464608]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2016-11-14 1353680]
"Malwarebytes TrayApp"=C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2017-01-20 2780112]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2017-03-14 27545048]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"PWMTRV"=rundll32 C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL,PwrMgrBkGndMonitor []
"IMSS"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [2013-07-02 113656]
"RotateImage"=C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [2008-10-30 55808]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
Digital Line Detect.lnk - C:\Program Files (x86)\Digital Line Detect\DLG.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\System32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2016-03-02 451584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages" = scecli
C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableCAD"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"StubPath" = "C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.96\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux1"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"wave9"=wdmaud.drv
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv
"aux3"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

====== File associations ======

.ini - open - "%SystemRoot%\system32\NOTEPAD.EXE" %1
.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - "%SystemRoot%\system32\NOTEPAD.EXE" %1

====== List of files/folders created in the last 1 month ======

2017-05-08 16:23:06 ----D---- C:\_OTM
2017-05-08 11:47:04 ----A---- C:\Windows\system32\FNTCACHE.DAT
2017-05-08 11:41:15 ----D---- C:\AdwCleaner
2017-05-08 11:22:44 ----D---- C:\rsit
2017-05-08 11:22:44 ----D---- C:\Program Files\trend micro
2017-05-08 11:10:01 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2017-05-08 11:09:56 ----D---- C:\Program Files\Mozilla Firefox
2017-05-08 10:54:54 ----SHD---- C:\$RECYCLE.BIN
2017-05-08 10:54:47 ----D---- C:\Windows\temp
2017-05-08 10:54:45 ----A---- C:\ComboFix.txt
2017-05-08 10:41:23 ----A---- C:\Windows\zip.exe
2017-05-08 10:41:23 ----A---- C:\Windows\SWSC.exe
2017-05-08 10:41:23 ----A---- C:\Windows\SWREG.exe
2017-05-08 10:41:23 ----A---- C:\Windows\sed.exe
2017-05-08 10:41:23 ----A---- C:\Windows\PEV.exe
2017-05-08 10:41:23 ----A---- C:\Windows\NIRCMD.exe
2017-05-08 10:41:23 ----A---- C:\Windows\MBR.exe
2017-05-08 10:41:23 ----A---- C:\Windows\grep.exe
2017-05-08 10:39:50 ----D---- C:\Qoobox
2017-05-08 10:39:28 ----D---- C:\Windows\erdnt
2017-05-07 21:15:19 ----D---- C:\Users\PC\AppData\Roaming\Mozilla
2017-05-07 20:54:07 ----A---- C:\Windows\system32\drivers\MBAMChameleon.sys
2017-05-07 20:54:06 ----A---- C:\Windows\system32\drivers\mwac.sys
2017-05-07 20:54:06 ----A---- C:\Windows\system32\drivers\farflt.sys
2017-05-07 20:54:03 ----A---- C:\Windows\system32\drivers\mbam.sys
2017-05-07 20:53:30 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2017-05-07 20:53:18 ----A---- C:\Windows\system32\drivers\mbae64.sys
2017-05-07 20:53:11 ----D---- C:\ProgramData\Malwarebytes
2017-05-07 20:53:11 ----D---- C:\Program Files\Malwarebytes
2017-05-07 19:52:04 ----D---- C:\Program Files (x86)\MozBackup
2017-05-06 19:06:24 ----D---- C:\Program Files\Common Files\adaware
2017-05-06 19:05:40 ----D---- C:\ProgramData\Lavasoft
2017-05-06 15:11:25 ----D---- C:\ProgramData\Spybot - Search & Destroy
2017-05-06 15:11:08 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-05-06 14:40:46 ----D---- C:\Program Files\61GIPRPJJP
2017-05-06 14:35:51 ----D---- C:\ProgramData\{B58DB328-0226-0483-C45B-94C93C8C56C3}
2017-05-06 14:34:24 ----D---- C:\Program Files\ID6PRZNMNG
2017-05-06 14:34:18 ----D---- C:\Program Files\B8U9ZQ4633
2017-05-06 14:34:12 ----D---- C:\Program Files\I091IWDH8V
2017-04-24 22:13:26 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-64.dll
2017-04-12 21:41:51 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2017-04-12 21:41:51 ----A---- C:\Windows\system32\rdpcorets.dll
2017-04-12 21:41:50 ----A---- C:\Windows\system32\mshtml.dll
2017-04-12 21:41:49 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-04-12 21:41:48 ----A---- C:\Windows\system32\ieframe.dll
2017-04-12 21:41:46 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-04-12 21:41:45 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-04-12 21:41:45 ----A---- C:\Windows\system32\wininet.dll
2017-04-12 21:41:44 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-04-12 21:41:44 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\wuaueng.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\win32k.sys
2017-04-12 21:41:44 ----A---- C:\Windows\system32\urlmon.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\ole32.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\iertutil.dll
2017-04-12 21:41:43 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-04-12 21:41:43 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\wucltux.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\wuapi.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\win32spl.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\samsrv.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\ucrtbase.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\quartz.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\msfeeds.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\cdosys.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\atmfd.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\quartz.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2017-04-12 21:41:41 ----A---- C:\Windows\system32\gdi32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\ucrtbase.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\iedkcs32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l2-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\jscript.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-12 21:41:38 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-04-12 21:41:38 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-04-12 21:41:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-04-12 21:41:36 ----A---- C:\Windows\system32\ntdll.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\mfmjpegdec.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\asycfilt.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\webcheck.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\samlib.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\mfmjpegdec.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\jscript9.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-04-12 21:41:35 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-04-12 21:41:35 ----A---- C:\Windows\system32\asycfilt.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\samlib.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\cdosys.dll
2017-04-12 21:41:34 ----A---- C:\Windows\system32\rdpudd.dll
2017-04-12 21:41:34 ----A---- C:\Windows\system32\ie4uinit.exe
2017-04-12 21:41:34 ----A---- C:\Windows\system32\certcli.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\wups.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wuwebv.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wups2.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wups.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wudriver.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\vbscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\srcore.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\rpcrt4.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\ieapfltr.dll
2017-04-12 21:41:32 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2017-04-12 21:41:32 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\wuauclt.exe
2017-04-12 21:41:32 ----A---- C:\Windows\system32\lsasrv.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\ieui.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\dxtrans.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\dxtmsft.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-04-12 21:41:31 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\srclient.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\smss.exe
2017-04-12 21:41:31 ----A---- C:\Windows\system32\msrating.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\mshtmled.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\kerberos.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\advapi32.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\WinSetupUI.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\rstrui.exe
2017-04-12 21:41:30 ----A---- C:\Windows\system32\occache.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\kernel32.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\jscript9diag.dll
2017-04-12 21:41:29 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\schannel.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-12 21:41:29 ----A---- C:\Windows\system32\jsproxy.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\ieUnatt.exe
2017-04-12 21:41:29 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-04-12 21:41:29 ----A---- C:\Windows\system32\conhost.exe
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\wow64win.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\winsrv.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\ncrypt.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\msv1_0.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\KernelBase.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\inseng.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\wuapp.exe
2017-04-12 21:41:27 ----A---- C:\Windows\system32\wdigest.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\TSpkg.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\sspicli.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\iesetup.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\wow64.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\rpchttp.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\iernonce.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-04-12 21:41:26 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-04-12 21:41:26 ----A---- C:\Windows\system32\csrsrv.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\cdd.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\bcrypt.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-04-12 21:41:25 ----A---- C:\Windows\system32\drivers\appid.sys
2017-04-12 21:41:25 ----A---- C:\Windows\system32\cryptbase.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\wow64cpu.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\sspisrv.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\lsass.exe
2017-04-12 21:41:24 ----A---- C:\Windows\system32\lpk.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\secur32.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\fontsub.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\dciman32.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\appidsvc.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\appidapi.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\lpk.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\ntvdm64.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\credssp.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\auditpol.exe
2017-04-12 21:41:22 ----A---- C:\Windows\system32\atmlib.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-04-12 21:41:22 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\user.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\tzres.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\tzres.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\msaudite.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\apisetschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\adtschema.dll
2017-04-12 21:41:19 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-04-12 21:41:19 ----A---- C:\Windows\system32\msobjs.dll
2017-04-12 21:41:19 ----A---- C:\Windows\system32\ieetwcollectorres.dll

====== List of files/folders modified in the last 1 month ======

2017-05-08 18:19:52 ----D---- C:\Windows\Prefetch
2017-05-08 18:19:23 ----A---- C:\Windows\SYSWOW64\log.txt
2017-05-08 18:18:31 ----D---- C:\Users\PC\AppData\Roaming\Skype
2017-05-08 18:17:43 ----D---- C:\Windows\system32\drivers
2017-05-08 18:15:53 ----D---- C:\Windows\system32\config
2017-05-08 16:26:36 ----D---- C:\Program Files (x86)\TeamViewer
2017-05-08 16:18:48 ----D---- C:\Windows\System32
2017-05-08 16:18:48 ----D---- C:\Windows\inf
2017-05-08 16:18:48 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-05-08 11:47:18 ----D---- C:\Windows
2017-05-08 11:22:44 ----RD---- C:\Program Files
2017-05-08 11:10:01 ----RD---- C:\Program Files (x86)
2017-05-08 11:02:16 ----D---- C:\Program Files (x86)\Mozilla Firefox
2017-05-08 10:50:58 ----A---- C:\Windows\system.ini
2017-05-08 10:50:47 ----D---- C:\Windows\system32\drivers\etc
2017-05-08 10:50:06 ----D---- C:\Windows\SysWOW64
2017-05-08 10:46:50 ----D---- C:\Windows\SYSWOW64\drivers
2017-05-08 10:46:50 ----D---- C:\Windows\AppPatch
2017-05-08 10:46:49 ----D---- C:\Program Files (x86)\Common Files
2017-05-07 20:53:11 ----D---- C:\ProgramData
2017-05-07 20:50:25 ----SHD---- C:\Windows\Installer
2017-05-07 20:46:01 ----D---- C:\Program Files (x86)\Google
2017-05-07 20:45:22 ----D---- C:\Windows\system32\Tasks
2017-05-07 17:44:57 ----SHD---- C:\System Volume Information
2017-05-07 17:18:40 ----D---- C:\Windows\Tasks
2017-05-07 16:46:45 ----RSD---- C:\Windows\Fonts
2017-05-07 16:46:44 ----D---- C:\Users\PC\AppData\Roaming\TeamViewer
2017-05-07 08:23:43 ----SD---- C:\ProgramData\Microsoft
2017-05-06 19:06:24 ----D---- C:\Program Files\Common Files
2017-05-06 15:30:17 ----D---- C:\Program Files\Common Files\AV
2017-05-06 15:03:48 ----D---- C:\Windows\Panther
2017-05-06 15:03:47 ----D---- C:\Windows\Logs
2017-05-06 15:03:46 ----D---- C:\Windows\Minidump
2017-05-06 15:03:46 ----D---- C:\Windows\debug
2017-05-06 13:25:29 ----D---- C:\ProgramData\Microsoft Help
2017-05-06 13:24:45 ----RSD---- C:\Windows\assembly
2017-05-01 19:32:10 ----D---- C:\Windows\system32\catroot2
2017-04-24 23:40:45 ----D---- C:\ProgramData\Oracle
2017-04-24 22:13:39 ----D---- C:\Program Files (x86)\Java
2017-04-24 22:13:23 ----D---- C:\Program Files\Java
2017-04-24 22:12:24 ----A---- C:\Windows\system32\WindowsAccessBridge-64.dll
2017-04-24 22:11:19 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2017-04-13 19:12:15 ----D---- C:\Windows\LiveKernelReports
2017-04-13 08:08:55 ----D---- C:\Windows\rescache
2017-04-13 07:29:53 ----D---- C:\Windows\winsxs
2017-04-13 07:26:53 ----D---- C:\Windows\SYSWOW64\en-US
2017-04-13 07:26:53 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-04-13 07:26:53 ----D---- C:\Program Files\Internet Explorer
2017-04-13 07:26:51 ----D---- C:\Windows\system32\en-US
2017-04-13 07:26:51 ----D---- C:\Windows\system32\cs-CZ
2017-04-13 07:26:50 ----D---- C:\Windows\system32\Boot
2017-04-13 07:26:50 ----D---- C:\Program Files (x86)\Internet Explorer
2017-04-13 07:08:33 ----D---- C:\Program Files\Microsoft Silverlight
2017-04-13 07:08:33 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2017-04-13 07:07:25 ----D---- C:\Windows\Microsoft.NET
2017-04-13 07:06:53 ----D---- C:\Windows\system32\MRT
2017-04-13 06:57:53 ----AC---- C:\Windows\system32\MRT.exe
2017-04-13 06:53:01 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-04-12 07:43:58 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2017-04-12 07:43:52 ----D---- C:\Windows\system32\Macromed
2017-04-12 07:43:50 ----D---- C:\Windows\SYSWOW64\Macromed

File C:\Windows\system32\winlogon.exe is digitally signed
File C:\Windows\system32\wininit.exe is digitally signed
File C:\Windows\explorer.exe is digitally signed
File C:\Windows\SysWOW64\explorer.exe is digitally signed
File C:\Windows\system32\svchost.exe is digitally signed
File C:\Windows\SysWOW64\svchost.exe is digitally signed
File C:\Windows\system32\services.exe is digitally signed
File C:\Windows\system32\User32.dll is digitally signed
File C:\Windows\SysWOW64\User32.dll is digitally signed
File C:\Windows\system32\userinit.exe is digitally signed
File C:\Windows\SysWOW64\userinit.exe is digitally signed
File C:\Windows\system32\rpcss.dll is digitally signed
File C:\Windows\system32\Drivers\volsnap.sys is digitally signed

====== List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R0 DzHDD64;DzHDD64; C:\Windows\System32\DRIVERS\DzHDD64.sys [2016-04-14 29512]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2012-05-30 569152]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2016-08-25 295000]
R0 nvpciflt;nvpciflt; C:\Windows\system32\DRIVERS\nvpciflt.sys [2013-10-29 30496]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 ESProtectionDriver;Malwarebytes Anti-Exploit; \??\C:\Windows\system32\drivers\mbae64.sys [2017-03-22 77440]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiifx64.sys [2013-05-22 15472]
R1 nvkflt;nvkflt; C:\Windows\system32\DRIVERS\nvkflt.sys [2013-10-29 284448]
R1 TPPWRIF;TPPWRIF; C:\Windows\System32\drivers\Tppwr64v.sys [2016-04-14 29008]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 MBAMChameleon;MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [2017-05-07 186304]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 17024]
R2 risdxc;risdxc; C:\Windows\system32\DRIVERS\risdxc64.sys [2011-05-25 101888]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2014-05-07 11576]
R3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2011-03-04 166016]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 btwampfl;btwampfl Bluetooth filter driver; \??\C:\Windows\system32\drivers\btwampfl.sys [2012-12-04 598808]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2012-05-02 184144]
R3 btwavdt;Bluetooth AVDT; C:\Windows\system32\DRIVERS\btwavdt.sys [2012-03-06 210984]
R3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2011-09-18 39976]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2012-03-06 21544]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2012-06-04 1580704]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2015-10-29 506880]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2016-09-06 82232]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2016-03-02 5384728]
R3 MBAMFarflt;MBAMFarflt; \??\C:\Windows\system32\drivers\farflt.sys [2017-05-08 111544]
R3 MBAMProtection;MBAMProtection; \??\C:\Windows\system32\drivers\mbam.sys [2017-05-08 43968]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2017-05-08 251832]
R3 MBAMWebProtection;MBAMWebProtection; \??\C:\Windows\system32\drivers\mwac.sys [2017-05-08 82720]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2012-11-09 57376]
R3 NETw5s64;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2016-08-25 135928]
R3 psadd;Lenovo Parties Service Access Device Driver; C:\Windows\system32\DRIVERS\psadd.sys [2009-12-08 37440]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RtlvVga;RtlvVga; C:\Windows\system32\DRIVERS\RtlvVga.sys [2014-03-18 11920]
R3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2014-07-28 45296]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-14 12288]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2014-07-28 461552]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmpx64.sys [2009-09-03 67072]
S2 rimspci;rimspci; C:\Windows\system32\DRIVERS\rimspe64.sys [2009-10-26 61952]
S2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimspx64.sys [2009-09-03 54784]
S2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdpx64.sys [2009-09-03 57856]
S3 ATSwpWDF;AuthenTec TruePrint USB Driver; C:\Windows\System32\Drivers\ATSwpWDF.sys [2010-02-05 736840]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 btusbflt;Bluetooth USB Filter; C:\Windows\system32\drivers\btusbflt.sys [2010-04-09 54824]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CAXHWAZL;CAXHWAZL; C:\Windows\system32\DRIVERS\CAXHWAZL.sys [2009-06-30 292864]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K; C:\Windows\system32\DRIVERS\e1k62x64.sys [2011-07-20 342704]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver; C:\Windows\system32\DRIVERS\e1y62x64.sys [2010-04-07 290008]
S3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2012-11-09 57376]
S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\CAX_DPV.sys [2009-06-30 1486848]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2013-01-23 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2013-01-23 27136]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2013-02-25 194848]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2012-10-17 26112]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter; C:\Windows\system32\DRIVERS\rtwlane.sys [2015-01-06 3709656]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-21 109056]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2013-01-23 9216]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 usbser;USB Modem Driver; C:\Windows\system32\DRIVERS\usbser.sys [2013-08-29 33280]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2013-01-23 9216]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]

====== List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-04-25 83056]
R2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe [2013-05-14 1008344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\cscsvc.dll
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; %SystemRoot%\System32\svchost.exe -k utcsvc;"ServiceDll" = %SystemRoot%\system32\diagtrack.dll
R2 HsfXAudioService;HsfXAudioService; %SystemRoot%\system32\svchost.exe -k HsfXAudioService;"ServiceDll" = C:\Windows\SysWOW64\XAudio64.dll
R2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2016-09-06 180736]
R2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service; C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [2014-07-09 214464]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute; C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [2013-05-29 44024]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-05-27 110128]
R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction; C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2013-05-29 62456]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-07-02 327672]
R2 MBAMService;Malwarebytes Service; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [2017-01-20 4355024]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2016-11-14 119864]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-10-29 893216]
R2 SamsungUPDUtilSvc;Samsung UPD Utility Service; C:\Windows\SysWOW64\SecUPDUtilSvc.exe [2016-05-22 143664]
R2 TeamViewer;TeamViewer 12; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2017-04-25 10888944]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 125424]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2014-05-27 125488]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2013-07-02 2595832]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2016-11-14 361816]
R3 SUService;System Update; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [2017-01-18 23416]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-03-20 105096]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-03-20 125064]
S2 gupdate;Služba Aktualizace Google (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-07 153168]
S2 LPlatSvc;Lenovo Platform Service; C:\Windows\system32\LPlatSvc.exe [2016-09-06 710144]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2017-01-16 317400]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-12 271448]
S3 AppMgmt;@appmgmts.dll,-3250; %SystemRoot%\system32\svchost.exe -k netsvcs;"ServiceDll" = %SystemRoot%\System32\appmgmts.dll
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2016-03-02 290224]
S3 DozeSvc;Lenovo Doze Mode Service; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2016-04-14 326160]
S3 gupdatem;Služba Aktualizace Google (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-07 153168]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-03-25 114688]
S3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [2014-12-05 619776]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-05-04 191944]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-12-08 178760]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 5132888]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; %SystemRoot%\System32\svchost.exe -k PeerDist;"ServiceDll" = %SystemRoot%\system32\peerdistsvc.dll
S3 Power Manager DBC Service;Power Manager Service; C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2016-04-14 1668776]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2013-04-18 737616]
S3 ShareItSvc;ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [2016-01-20 31176]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\system32\storsvc.dll
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\umrdp.dll
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-03-20 51320]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]

-----------------EOF-----------------

Smazáno. Nastala nějaká změna?

Bohuzel, vsechnz prohlizece (Chrome, IE, Firefox) maji problemy nacitat stranky. Obcas nabehne, ale spis vetsinou pise, ze server neni dostupny. Internetove pripojeni by melo byt v poradu. Pocitac spravuju vzdalene pres teamviewer bez jedineho zadrhnuti pripojeni.

Pro jistotu prikladam novy scan:

Logfile of random's system information tool 1.16 (written by random/random)
Run by PC at 2017-05-08 19:45:17
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 228 GB (75%) free of 305 GB
Total RAM: 3871 MB (48% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:45:33, on 8.5.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18639)
Boot mode: Normal

Running processes:
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
C:\Program Files\ThinkPad\Bluetooth Software\Bluetooth Headset Helper.exe
C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe
C:\Program Files\trend micro\PC_RSITx64.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.cz/?gfe_rd=cr&ei=_f8 ... =ssl#spf=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll
O4 - HKLM\..\Run: [PWMTRV] rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [IMSS] "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [RotateImage] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files (x86)\Digital Line Detect\DLG.exe
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{188F5398-8881-43B3-ADA8-B61A7DFF6BE0}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{1EDAEE71-673D-4DF0-9D04-E2034A310C93}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{202E7AAF-2584-40D3-9169-60B6DAD619DF}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{29AF921B-5F20-4AAE-9A4A-BCA5F2DEF44D}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{30D86D8B-2C59-46E0-8B60-06DA6DF1E266}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{3348A0D7-4558-491F-81CE-7C6F110DA21E}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A20815E-01EC-4BD4-9EF8-9234B1B147ED}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{605F2096-7325-42DB-A22C-13C053B03D20}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{846ee342-7039-11de-9d20-806e6f6e6963}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A17FC28-21DF-45A4-98FA-0AED85926008}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{A23611C8-B1EA-4076-8E53-64E7149BF592}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{FFBE0C14-C8BE-48E3-84B4-DE53BB435A57}: NameServer = 8.8.8.8
O17 - HKLM\System\CS1\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O17 - HKLM\System\CS2\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Identity Protection Technology Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo EasyPlus Hotspot - Lenovo - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Lenovo Platform Service (LPlatSvc) - Unknown owner - C:\Windows\system32\LPlatSvc.exe (file missing)
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: Power Manager Service (Power Manager DBC Service) - Lenovo - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Samsung UPD Utility Service (SamsungUPDUtilSvc) - Unknown owner - C:\Windows\SysWOW64\SecUPDUtilSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ShareItSvc - SHAREit Technologies Co.Ltd - C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files (x86)\Lenovo\System Update\SUService.exe
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11037 bytes

====== Enumerating Processes ======

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\winlogon.exe
C:\Windows\system32\ibmpmsvc.exe
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
C:\Windows\system32\svchost.exe -k HsfXAudioService
"C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe"
"C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe"
"C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe"
C:\Windows\SysWOW64\SecUPDUtilSvc.exe
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"c:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\rundll32.exe "C:\Program Files\LENOVO\HOTKEY\hotkey.dll",InstallAudioHotkeyHook
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.FullScreenMagnifier
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
"C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"c:\program files (x86)\teamviewer\TeamViewer_Desktop.exe" --IPCport 5939
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
"C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe"
C:\Windows\SysWOW64\rundll32.exe
"C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Lenovo\System Update\SUService.exe"
"C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe"
"C:\Windows\SysWOW64\RunDll32.exe" "C:\Program Files\ThinkPad\Bluetooth Software\SysWOW64\BtMmHook.dll",SetAndWaitBtMmHook
"C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe" -Embedding
"C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe" -Embedding
"C:\Program Files\ThinkPad\Bluetooth Software\Bluetooth Headset Helper.exe"
"C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe" /start
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Users\PC\Desktop\RSITx64.exe"

====== Scheduled tasks folder ======

C:\Windows\system32\tasks\Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\system32\tasks\Adobe Flash Player Updater - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\system32\tasks\klcp_update - "C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe" /verysilent /update /freq=30
C:\Windows\system32\tasks\PMTask - C:\Program Files (x86)\ThinkPad\Utilities\PwmIdTsv.exe
C:\Windows\system32\tasks\SidebarExecute - C:\Program Files (x86)\Windows Sidebar\sidebar.exe /showGadgets
C:\Windows\system32\tasks\Synaptics TouchPad Enhancements - \Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\tasks\{0D1AEFEE-2309-F090-AF3D-12B63B9FF166} - C:\Windows\system32\regsvr32.exe /s /n /i:"/rt" "C:\PROGRA~3\207d4732\768720c1.dll"
C:\Windows\system32\tasks\{87EB3D5C-6FA0-4A1D-83AA-B32F937AD1B7} - "c:\program files (x86)\mozilla firefox\firefox.exe" http://ui.skype.com/ui/0/7.23.0.105/cs/ ... =tsInstall
C:\Windows\system32\tasks\WPD\SqmUpload_S-1-5-21-1790732064-3310509644-602799907-1000 - %windir%\system32\rundll32.exe portabledeviceapi.dll,#1
C:\Windows\system32\tasks\TVT\TVSUUpdateTask - "C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe" /CM -search C -action INSTALL -includerebootpackages 1,3,4 -noicon -noreboot -nolicense -defaultupdate -schtask
C:\Windows\system32\tasks\TVT\TVSUUpdateTask_UserLogOn - "C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe" PendingTask
C:\Windows\system32\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask - %systemroot%\system32\sc.exe start osppsvc
C:\Windows\system32\tasks\Microsoft\Windows\WindowsBackup\ConfigNotification - %systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
C:\Windows\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\Windows\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\Windows\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -queuereporting
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask - %SystemRoot%\system32\Wat\WatAdminSvc.exe /run
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline - %SystemRoot%\system32\schtasks.exe /run /I /TN "\Microsoft\Windows\Windows Activation Technologies\ValidationTask"
C:\Windows\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\Windows\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
C:\Windows\system32\tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask - sc.exe start sppsvc
C:\Windows\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\Windows\system32\tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem - %SystemRoot%\System32\powercfg.exe -energy -auto
C:\Windows\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\Windows\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService - %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks - %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ehDRMInit - %SystemRoot%\ehome\ehPrivJob.exe /DRMInit
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\InstallPlayReady - %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\mcupdate - %SystemRoot%\ehome\mcupdate $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURActivate - %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURDiscovery - %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscovery - %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 - %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 - %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PeriodicScanRetry - %windir%\ehome\MCUpdate.exe -pscn 0
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrScheduleTask - %SystemRoot%\ehome\mcupdate.exe -PvrSchedule
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RecordingRestart - %SystemRoot%\ehome\ehrec /RestartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RegisterSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ReindexSearchRoot - %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\StartRecording - %SystemRoot%\ehome\ehrec /StartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\UpdateRecordPath - %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotifications.exe
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\Windows\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\Windows\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\AitAgent - aitagent
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattel\DiagTrackRunner.exe /UploadEtlFilesOnly
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\Windows\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\Windows\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe
C:\Windows\system32\tasks\Microsoft\Office\Office 15 Subscription Heartbeat - %ProgramFiles%\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
C:\Windows\system32\tasks\Microsoft\Office\OfficeTelemetryAgentFallBack - "C:\Program Files\Microsoft Office\Office15\msoia.exe" scan upload mininterval:2880
C:\Windows\system32\tasks\Microsoft\Office\OfficeTelemetryAgentLogOn - "C:\Program Files\Microsoft Office\Office15\msoia.exe" scan upload
C:\Windows\system32\tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan - c:\Program Files\Microsoft Security Client\\MpCmdRun.exe Scan -ScheduleJob -RestrictPrivileges
C:\Windows\system32\tasks\Lenovo\Lenovo Customer Feedback Program 64 - "%ProgramFiles(x86)%\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe"
C:\Windows\system32\tasks\Lenovo\Lenovo Customer Feedback Program 64 35 - "%ProgramFiles(x86)%\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe"
C:\Windows\system32\tasks\Lenovo\Message Center Plus Launcher - "%programfiles(x86)%\Lenovo\message center plus\mcplaunch.exe" /start
C:\Windows\system32\tasks\AVAST Software\Avast settings backup - C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe /backup /iavs

=========Mozilla firefox=========

ProfilePath - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.148 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_148.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\SysWOW64\Adobe\Director\np32dsw_1224194.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]
"Description"=This plugin updates Intel WebAPI component
"Path"=C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.131.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.131.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_131\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/Lync,version=15.0]
"Description"=Microsoft Lync Plug-in for Firefox
"Path"=C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nokia.com/EnablerPlugin]
"Description"=Nokia Suite Enabler Plugin
"Path"=C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.148 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_148.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.131.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.131.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre1.8.0_131\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.2.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll


C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default\addons.json

C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default\extensions.json
Application Update Service Helper - extension - aushelper@mozilla.org - C:\Program Files\Mozilla Firefox\browser\features\aushelper@mozilla.org.xpi
Multi-process staged rollout - extension - e10srollout@mozilla.org - C:\Program Files\Mozilla Firefox\browser\features\e10srollout@mozilla.org.xpi
Pocket - extension - firefox@getpocket.com - C:\Program Files\Mozilla Firefox\browser\features\firefox@getpocket.com.xpi
Web Compat - extension - webcompat@mozilla.org - C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi
Default - theme - {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi

C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default\pluginreg.dat
Plugin - Shockwave Flash - 25.0.0.148 - C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_148.dll

=========Google Chrome=========

C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Extension aapocclcgogkmnckokdopfmhonfmgoek 1 Prezentace Google 0.9
Extension ahfgeienlihckogmohjhadlkjgocpleb 1 Obchod Chrome 0.2
Extension aohghmighlieiainnegkcijnfilokake 1 Dokumenty Google 0.9
Extension apdfllckaahabafndbhieahigkjlhalf 1 Disk Google 14.1
Extension bepbmhgboaologfdajaanbcjmnhjmhfn 0
Extension bgjpfhpjcgdppjbgnpnjllokbmcdllig 1 Seznam Lištička - Email 1.4.2
Extension blmojkbhnkkphngknkmgccmlenfaelkd 1 Seznam Lištička - Slovník 1.4.6
Extension blpcfgokakmgnkcojhhkbfbldkacnbeo 1 YouTube 4.2.8
Extension eemcgdkfndhakfknompkggombfjjjeno 1 Bookmark Manager 0.1
Extension ennkphjdgehloodpbhlhldgbnhmacadg 1 Settings 0.2
Extension eofcbnmajmjmplflapaojjnihcjkigck 2 Avast SafePrice 11.1.0.221
Extension felcaaldnbdncclmgdcncolpebgiejap 1 Tabulky Google 1.1
Extension fngmhnnpilhplaeedifhccceomclgfbg 1 Tables 78.0
Extension gfdkimpbcpahaombhbimeihdjnejgicl 1 Feedback 1.0
Extension ghbmnnjooekpmoecnnnilnnbdlolhkhi 1 Dokumenty Google offline 1.4
Extension gighmmpiobklfepjocnamgkkbiglidom 1 AdBlock 3.10.0
Extension kmendfapggjehodndflmmgagdbamhnfd 1 CryptoTokenExtension 0.9.46
Extension mfehgcgbbipciphmccgaenjidiccnmng 1 Cloud Print 0.1
Extension mfffpogegjflfpflabcdkioaeobkgjik 1 GaiaAuthExtension 0.0.1
Extension mgndgikekgjfcpckkfioiadnlibdjbkf 1 Chrome 0.1
Extension mhjfbmdgcfjbbpaeojofohoefgiehjai 1 Chrome PDF Viewer 1
Extension neajdppkdcdipfabeoofebfddakdcjhd 1 Google Network Speech 1.0
Extension nkeimhogjdpnpccoofpliimaahmaaome 1 Google Hangouts 1.3.2
Extension nmmhkkegccagdldgiimedpiccmgmieda 1 Platby Internetového obchodu Chrome 1.0.0.2
Extension olfeabkoenfaoljndfecamgilllcpiak 0 Seznam Lištička - Rychlá volba 1.9.1
Extension pjkljhegncpnkpknbcohdijeoejaedia 1 Gmail 8.1
Extension pkedcjkdefgpdelpbcmbmeomcjbeemfm 1 Chrome Media Router 5817.313.0.3
Homepage:
default_search_provider.search_url:
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Preferences
Homepage:
default_search_provider.search_url:

======Registry dump ======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2017-03-14 229064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_131\bin\ssv.dll [2017-04-24 571456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-04-24 234560]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll [2017-04-24 473152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL [2017-02-23 1743664]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-04-24 186944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SAIICpl.exe [2009-11-15 307768]
"LENOVO.TPKNRRES"=C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [2013-05-29 60920]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2016-03-02 183216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2016-03-02 411056]
"Persistence"=C:\Windows\system32\igfxpers.exe [2016-03-02 453544]
"CDAServer"=C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [2014-09-08 464608]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2016-11-14 1353680]
"Malwarebytes TrayApp"=C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2017-01-20 2780112]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2017-03-14 27545048]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"PWMTRV"=rundll32 C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL,PwrMgrBkGndMonitor []
"IMSS"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [2013-07-02 113656]
"RotateImage"=C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [2008-10-30 55808]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
Digital Line Detect.lnk - C:\Program Files (x86)\Digital Line Detect\DLG.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\System32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2016-03-02 451584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages" = scecli
C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableCAD"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"StubPath" = "C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.96\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux1"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"wave9"=wdmaud.drv
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv
"aux3"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

====== File associations ======

.ini - open - "%SystemRoot%\system32\NOTEPAD.EXE" %1
.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - "%SystemRoot%\system32\NOTEPAD.EXE" %1

====== List of files/folders created in the last 1 month ======

2017-05-08 19:44:03 ----D---- C:\Users\PC\AppData\Roaming\Mozilla
2017-05-08 19:43:52 ----D---- C:\Program Files\Mozilla Firefox
2017-05-08 16:23:06 ----D---- C:\_OTM
2017-05-08 11:47:04 ----A---- C:\Windows\system32\FNTCACHE.DAT
2017-05-08 11:41:15 ----D---- C:\AdwCleaner
2017-05-08 11:22:44 ----D---- C:\rsit
2017-05-08 11:22:44 ----D---- C:\Program Files\trend micro
2017-05-08 10:54:54 ----SHD---- C:\$RECYCLE.BIN
2017-05-08 10:54:47 ----D---- C:\Windows\temp
2017-05-08 10:54:45 ----A---- C:\ComboFix.txt
2017-05-08 10:41:23 ----A---- C:\Windows\zip.exe
2017-05-08 10:41:23 ----A---- C:\Windows\SWSC.exe
2017-05-08 10:41:23 ----A---- C:\Windows\SWREG.exe
2017-05-08 10:41:23 ----A---- C:\Windows\sed.exe
2017-05-08 10:41:23 ----A---- C:\Windows\PEV.exe
2017-05-08 10:41:23 ----A---- C:\Windows\NIRCMD.exe
2017-05-08 10:41:23 ----A---- C:\Windows\MBR.exe
2017-05-08 10:41:23 ----A---- C:\Windows\grep.exe
2017-05-08 10:39:50 ----D---- C:\Qoobox
2017-05-08 10:39:28 ----D---- C:\Windows\erdnt
2017-05-07 20:54:07 ----A---- C:\Windows\system32\drivers\MBAMChameleon.sys
2017-05-07 20:54:06 ----A---- C:\Windows\system32\drivers\mwac.sys
2017-05-07 20:54:06 ----A---- C:\Windows\system32\drivers\farflt.sys
2017-05-07 20:54:03 ----A---- C:\Windows\system32\drivers\mbam.sys
2017-05-07 20:53:30 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2017-05-07 20:53:18 ----A---- C:\Windows\system32\drivers\mbae64.sys
2017-05-07 20:53:11 ----D---- C:\ProgramData\Malwarebytes
2017-05-07 20:53:11 ----D---- C:\Program Files\Malwarebytes
2017-05-07 19:52:04 ----D---- C:\Program Files (x86)\MozBackup
2017-05-06 19:06:24 ----D---- C:\Program Files\Common Files\adaware
2017-05-06 19:05:40 ----D---- C:\ProgramData\Lavasoft
2017-05-06 15:11:25 ----D---- C:\ProgramData\Spybot - Search & Destroy
2017-05-06 15:11:08 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-05-06 14:40:46 ----D---- C:\Program Files\61GIPRPJJP
2017-05-06 14:35:51 ----D---- C:\ProgramData\{B58DB328-0226-0483-C45B-94C93C8C56C3}
2017-05-06 14:34:24 ----D---- C:\Program Files\ID6PRZNMNG
2017-05-06 14:34:18 ----D---- C:\Program Files\B8U9ZQ4633
2017-05-06 14:34:12 ----D---- C:\Program Files\I091IWDH8V
2017-04-24 22:13:26 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-64.dll
2017-04-12 21:41:51 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2017-04-12 21:41:51 ----A---- C:\Windows\system32\rdpcorets.dll
2017-04-12 21:41:50 ----A---- C:\Windows\system32\mshtml.dll
2017-04-12 21:41:49 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-04-12 21:41:48 ----A---- C:\Windows\system32\ieframe.dll
2017-04-12 21:41:46 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-04-12 21:41:45 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-04-12 21:41:45 ----A---- C:\Windows\system32\wininet.dll
2017-04-12 21:41:44 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-04-12 21:41:44 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\wuaueng.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\win32k.sys
2017-04-12 21:41:44 ----A---- C:\Windows\system32\urlmon.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\ole32.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\iertutil.dll
2017-04-12 21:41:43 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-04-12 21:41:43 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\wucltux.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\wuapi.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\win32spl.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\samsrv.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\ucrtbase.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\quartz.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\msfeeds.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\cdosys.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\atmfd.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\quartz.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2017-04-12 21:41:41 ----A---- C:\Windows\system32\gdi32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\ucrtbase.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\iedkcs32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l2-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\jscript.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-12 21:41:38 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-04-12 21:41:38 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-04-12 21:41:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-04-12 21:41:36 ----A---- C:\Windows\system32\ntdll.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\mfmjpegdec.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\asycfilt.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\webcheck.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\samlib.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\mfmjpegdec.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\jscript9.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-04-12 21:41:35 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-04-12 21:41:35 ----A---- C:\Windows\system32\asycfilt.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\samlib.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\cdosys.dll
2017-04-12 21:41:34 ----A---- C:\Windows\system32\rdpudd.dll
2017-04-12 21:41:34 ----A---- C:\Windows\system32\ie4uinit.exe
2017-04-12 21:41:34 ----A---- C:\Windows\system32\certcli.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\wups.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wuwebv.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wups2.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wups.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wudriver.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\vbscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\srcore.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\rpcrt4.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\ieapfltr.dll
2017-04-12 21:41:32 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2017-04-12 21:41:32 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\wuauclt.exe
2017-04-12 21:41:32 ----A---- C:\Windows\system32\lsasrv.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\ieui.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\dxtrans.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\dxtmsft.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-04-12 21:41:31 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\srclient.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\smss.exe
2017-04-12 21:41:31 ----A---- C:\Windows\system32\msrating.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\mshtmled.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\kerberos.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\advapi32.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\WinSetupUI.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\rstrui.exe
2017-04-12 21:41:30 ----A---- C:\Windows\system32\occache.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\kernel32.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\jscript9diag.dll
2017-04-12 21:41:29 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\schannel.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-12 21:41:29 ----A---- C:\Windows\system32\jsproxy.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\ieUnatt.exe
2017-04-12 21:41:29 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-04-12 21:41:29 ----A---- C:\Windows\system32\conhost.exe
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\wow64win.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\winsrv.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\ncrypt.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\msv1_0.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\KernelBase.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\inseng.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\wuapp.exe
2017-04-12 21:41:27 ----A---- C:\Windows\system32\wdigest.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\TSpkg.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\sspicli.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\iesetup.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\wow64.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\rpchttp.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\iernonce.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-04-12 21:41:26 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-04-12 21:41:26 ----A---- C:\Windows\system32\csrsrv.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\cdd.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\bcrypt.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-04-12 21:41:25 ----A---- C:\Windows\system32\drivers\appid.sys
2017-04-12 21:41:25 ----A---- C:\Windows\system32\cryptbase.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\wow64cpu.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\sspisrv.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\lsass.exe
2017-04-12 21:41:24 ----A---- C:\Windows\system32\lpk.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\secur32.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\fontsub.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\dciman32.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\appidsvc.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\appidapi.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\lpk.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\ntvdm64.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\credssp.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\auditpol.exe
2017-04-12 21:41:22 ----A---- C:\Windows\system32\atmlib.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-04-12 21:41:22 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\user.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\tzres.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\tzres.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\msaudite.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\apisetschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\adtschema.dll
2017-04-12 21:41:19 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-04-12 21:41:19 ----A---- C:\Windows\system32\msobjs.dll
2017-04-12 21:41:19 ----A---- C:\Windows\system32\ieetwcollectorres.dll

====== List of files/folders modified in the last 1 month ======

2017-05-08 19:43:52 ----RD---- C:\Program Files
2017-05-08 19:43:21 ----D---- C:\Windows\Prefetch
2017-05-08 19:37:22 ----RD---- C:\Program Files (x86)
2017-05-08 19:37:20 ----D---- C:\Program Files (x86)\Mozilla Firefox
2017-05-08 18:21:28 ----D---- C:\Windows\System32
2017-05-08 18:21:28 ----D---- C:\Windows\inf
2017-05-08 18:21:28 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-05-08 18:19:25 ----A---- C:\Windows\SYSWOW64\log.txt
2017-05-08 18:18:31 ----D---- C:\Users\PC\AppData\Roaming\Skype
2017-05-08 18:17:43 ----D---- C:\Windows\system32\drivers
2017-05-08 18:15:53 ----D---- C:\Windows\system32\config
2017-05-08 16:26:36 ----D---- C:\Program Files (x86)\TeamViewer
2017-05-08 11:47:18 ----D---- C:\Windows
2017-05-08 10:50:58 ----A---- C:\Windows\system.ini
2017-05-08 10:50:47 ----D---- C:\Windows\system32\drivers\etc
2017-05-08 10:50:06 ----D---- C:\Windows\SysWOW64
2017-05-08 10:46:50 ----D---- C:\Windows\SYSWOW64\drivers
2017-05-08 10:46:50 ----D---- C:\Windows\AppPatch
2017-05-08 10:46:49 ----D---- C:\Program Files (x86)\Common Files
2017-05-07 20:53:11 ----D---- C:\ProgramData
2017-05-07 20:50:25 ----SHD---- C:\Windows\Installer
2017-05-07 20:46:01 ----D---- C:\Program Files (x86)\Google
2017-05-07 20:45:22 ----D---- C:\Windows\system32\Tasks
2017-05-07 17:44:57 ----SHD---- C:\System Volume Information
2017-05-07 17:18:40 ----D---- C:\Windows\Tasks
2017-05-07 16:46:45 ----RSD---- C:\Windows\Fonts
2017-05-07 16:46:44 ----D---- C:\Users\PC\AppData\Roaming\TeamViewer
2017-05-07 08:23:43 ----SD---- C:\ProgramData\Microsoft
2017-05-06 19:06:24 ----D---- C:\Program Files\Common Files
2017-05-06 15:30:17 ----D---- C:\Program Files\Common Files\AV
2017-05-06 15:03:48 ----D---- C:\Windows\Panther
2017-05-06 15:03:47 ----D---- C:\Windows\Logs
2017-05-06 15:03:46 ----D---- C:\Windows\Minidump
2017-05-06 15:03:46 ----D---- C:\Windows\debug
2017-05-06 13:25:29 ----D---- C:\ProgramData\Microsoft Help
2017-05-06 13:24:45 ----RSD---- C:\Windows\assembly
2017-05-01 19:32:10 ----D---- C:\Windows\system32\catroot2
2017-04-24 23:40:45 ----D---- C:\ProgramData\Oracle
2017-04-24 22:13:39 ----D---- C:\Program Files (x86)\Java
2017-04-24 22:13:23 ----D---- C:\Program Files\Java
2017-04-24 22:12:24 ----A---- C:\Windows\system32\WindowsAccessBridge-64.dll
2017-04-24 22:11:19 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2017-04-13 19:12:15 ----D---- C:\Windows\LiveKernelReports
2017-04-13 08:08:55 ----D---- C:\Windows\rescache
2017-04-13 07:29:53 ----D---- C:\Windows\winsxs
2017-04-13 07:26:53 ----D---- C:\Windows\SYSWOW64\en-US
2017-04-13 07:26:53 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-04-13 07:26:53 ----D---- C:\Program Files\Internet Explorer
2017-04-13 07:26:51 ----D---- C:\Windows\system32\en-US
2017-04-13 07:26:51 ----D---- C:\Windows\system32\cs-CZ
2017-04-13 07:26:50 ----D---- C:\Windows\system32\Boot
2017-04-13 07:26:50 ----D---- C:\Program Files (x86)\Internet Explorer
2017-04-13 07:08:33 ----D---- C:\Program Files\Microsoft Silverlight
2017-04-13 07:08:33 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2017-04-13 07:07:25 ----D---- C:\Windows\Microsoft.NET
2017-04-13 07:06:53 ----D---- C:\Windows\system32\MRT
2017-04-13 06:57:53 ----AC---- C:\Windows\system32\MRT.exe
2017-04-13 06:53:01 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-04-12 07:43:58 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2017-04-12 07:43:52 ----D---- C:\Windows\system32\Macromed
2017-04-12 07:43:50 ----D---- C:\Windows\SYSWOW64\Macromed

File C:\Windows\system32\winlogon.exe is digitally signed
File C:\Windows\system32\wininit.exe is digitally signed
File C:\Windows\explorer.exe is digitally signed
File C:\Windows\SysWOW64\explorer.exe is digitally signed
File C:\Windows\system32\svchost.exe is digitally signed
File C:\Windows\SysWOW64\svchost.exe is digitally signed
File C:\Windows\system32\services.exe is digitally signed
File C:\Windows\system32\User32.dll is digitally signed
File C:\Windows\SysWOW64\User32.dll is digitally signed
File C:\Windows\system32\userinit.exe is digitally signed
File C:\Windows\SysWOW64\userinit.exe is digitally signed
File C:\Windows\system32\rpcss.dll is digitally signed
File C:\Windows\system32\Drivers\volsnap.sys is digitally signed

====== List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R0 DzHDD64;DzHDD64; C:\Windows\System32\DRIVERS\DzHDD64.sys [2016-04-14 29512]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2012-05-30 569152]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2016-08-25 295000]
R0 nvpciflt;nvpciflt; C:\Windows\system32\DRIVERS\nvpciflt.sys [2013-10-29 30496]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 ESProtectionDriver;Malwarebytes Anti-Exploit; \??\C:\Windows\system32\drivers\mbae64.sys [2017-03-22 77440]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiifx64.sys [2013-05-22 15472]
R1 nvkflt;nvkflt; C:\Windows\system32\DRIVERS\nvkflt.sys [2013-10-29 284448]
R1 TPPWRIF;TPPWRIF; C:\Windows\System32\drivers\Tppwr64v.sys [2016-04-14 29008]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 MBAMChameleon;MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [2017-05-07 186304]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 17024]
R2 risdxc;risdxc; C:\Windows\system32\DRIVERS\risdxc64.sys [2011-05-25 101888]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2014-05-07 11576]
R3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2011-03-04 166016]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 btwampfl;btwampfl Bluetooth filter driver; \??\C:\Windows\system32\drivers\btwampfl.sys [2012-12-04 598808]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2012-05-02 184144]
R3 btwavdt;Bluetooth AVDT; C:\Windows\system32\DRIVERS\btwavdt.sys [2012-03-06 210984]
R3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2011-09-18 39976]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2012-03-06 21544]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2012-06-04 1580704]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2015-10-29 506880]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2016-09-06 82232]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2016-03-02 5384728]
R3 MBAMFarflt;MBAMFarflt; \??\C:\Windows\system32\drivers\farflt.sys [2017-05-08 111544]
R3 MBAMProtection;MBAMProtection; \??\C:\Windows\system32\drivers\mbam.sys [2017-05-08 43968]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2017-05-08 251832]
R3 MBAMWebProtection;MBAMWebProtection; \??\C:\Windows\system32\drivers\mwac.sys [2017-05-08 82720]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2012-11-09 57376]
R3 NETw5s64;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2016-08-25 135928]
R3 psadd;Lenovo Parties Service Access Device Driver; C:\Windows\system32\DRIVERS\psadd.sys [2009-12-08 37440]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RtlvVga;RtlvVga; C:\Windows\system32\DRIVERS\RtlvVga.sys [2014-03-18 11920]
R3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2014-07-28 45296]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-14 12288]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2014-07-28 461552]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmpx64.sys [2009-09-03 67072]
S2 rimspci;rimspci; C:\Windows\system32\DRIVERS\rimspe64.sys [2009-10-26 61952]
S2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimspx64.sys [2009-09-03 54784]
S2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdpx64.sys [2009-09-03 57856]
S3 ATSwpWDF;AuthenTec TruePrint USB Driver; C:\Windows\System32\Drivers\ATSwpWDF.sys [2010-02-05 736840]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 btusbflt;Bluetooth USB Filter; C:\Windows\system32\drivers\btusbflt.sys [2010-04-09 54824]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CAXHWAZL;CAXHWAZL; C:\Windows\system32\DRIVERS\CAXHWAZL.sys [2009-06-30 292864]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K; C:\Windows\system32\DRIVERS\e1k62x64.sys [2011-07-20 342704]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver; C:\Windows\system32\DRIVERS\e1y62x64.sys [2010-04-07 290008]
S3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2012-11-09 57376]
S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\CAX_DPV.sys [2009-06-30 1486848]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2013-01-23 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2013-01-23 27136]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2013-02-25 194848]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2012-10-17 26112]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter; C:\Windows\system32\DRIVERS\rtwlane.sys [2015-01-06 3709656]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-21 109056]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2013-01-23 9216]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 usbser;USB Modem Driver; C:\Windows\system32\DRIVERS\usbser.sys [2013-08-29 33280]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2013-01-23 9216]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]

====== List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-04-25 83056]
R2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe [2013-05-14 1008344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\cscsvc.dll
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; %SystemRoot%\System32\svchost.exe -k utcsvc;"ServiceDll" = %SystemRoot%\system32\diagtrack.dll
R2 HsfXAudioService;HsfXAudioService; %SystemRoot%\system32\svchost.exe -k HsfXAudioService;"ServiceDll" = C:\Windows\SysWOW64\XAudio64.dll
R2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2016-09-06 180736]
R2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service; C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [2014-07-09 214464]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute; C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [2013-05-29 44024]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-05-27 110128]
R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction; C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2013-05-29 62456]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-07-02 327672]
R2 MBAMService;Malwarebytes Service; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [2017-01-20 4355024]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2016-11-14 119864]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-10-29 893216]
R2 SamsungUPDUtilSvc;Samsung UPD Utility Service; C:\Windows\SysWOW64\SecUPDUtilSvc.exe [2016-05-22 143664]
R2 TeamViewer;TeamViewer 12; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2017-04-25 10888944]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 125424]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2014-05-27 125488]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2013-07-02 2595832]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2016-11-14 361816]
R3 Power Manager DBC Service;Power Manager Service; C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2016-04-14 1668776]
R3 SUService;System Update; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [2017-01-18 23416]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-03-20 105096]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-03-20 125064]
S2 gupdate;Služba Aktualizace Google (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-07 153168]
S2 LPlatSvc;Lenovo Platform Service; C:\Windows\system32\LPlatSvc.exe [2016-09-06 710144]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2017-01-16 317400]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-12 271448]
S3 AppMgmt;@appmgmts.dll,-3250; %SystemRoot%\system32\svchost.exe -k netsvcs;"ServiceDll" = %SystemRoot%\System32\appmgmts.dll
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2016-03-02 290224]
S3 DozeSvc;Lenovo Doze Mode Service; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2016-04-14 326160]
S3 gupdatem;Služba Aktualizace Google (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-07 153168]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-03-25 114688]
S3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [2014-12-05 619776]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-12-08 178760]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 5132888]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; %SystemRoot%\System32\svchost.exe -k PeerDist;"ServiceDll" = %SystemRoot%\system32\peerdistsvc.dll
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2013-04-18 737616]
S3 ShareItSvc;ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [2016-01-20 31176]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\system32\storsvc.dll
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\umrdp.dll
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-03-20 51320]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]

-----------------EOF-----------------

Zkusíme prohlížeče vyčistit. Spusťte tyto utility:

1. Stahnete Zoek.exe http://download.bleepingcomputer.com/smeenk/zoek.exe a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
Do okna vlozte skript nize

autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;

Nasledne kliknete na Run Script
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem.

a

2. Junkware removal tool: http://thisisudax.org/downloads/JRT.exe
•Ulozte nejlepe na plochu
•Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
•Probehne vytvoreni zalohy a nasledne prohledavani
•Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte.

Zoek.exe v5.0.0.1 Updated 27-09-2015
Tool run by PC on po 08.05.2017 at 21:49:10,76.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode No Internet Access Detected
Launched: C:\Users\PC\Desktop\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2017-05-08-190204.log 3038 bytes

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\Users\PC\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

Added to C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions ======================

AppDir: C:\Program Files\Mozilla Firefox
- Undetermined - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default
E7C63595995846737C897C9595BC05E0 - C:\Program Files\VideoLAN\VLC\npvlc.dll - VLC Web Plugin
F3CA2CB85343242C90065137BED6357D - c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll - Silverlight Plug-In
906061B57CF52CFE36F307F255B4D44E - c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrlui.dll - Microsoft® Silverlight
5BE30CD14C617E52FBC0FA51AFEE82DF - C:\Program Files\Java\jre1.8.0_131\bin\plugin2\npjp2.dll - Java(TM) Platform SE 8 U131
EF7CE6ED7B5BCB41B4165F402D22135A - C:\Program Files\Java\jre1.8.0_131\bin\dtplugin\npdeployJava1.dll - Java Deployment Toolkit 8.0.1310.11


==== Fake Chromium Profiles Check ======================

Fake profile C:\Users\Default\AppData\Local\Google\Chrome deleted

==== Chromium Look ======================


Chrome Media Router - PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.google.cz/?gfe_rd=cr&ei=_f8 ... =ssl#spf=1"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.google.cz/?gfe_rd=cr&ei=_f8 ... =ssl#spf=1"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IESR02"
{DFA264BD-5A0D-4CEB-86B0-13E81A879E39} Seznam TV Program Url="http://tv.seznam.cz/hledej?w={searchTer ... arch_16194"

==== Reset Google Chrome ======================

C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6BGVHFPN will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Users\PC\AppData\Local\Mozilla\Firefox\Profiles\pcfxdrmr.default\cache2 emptied successfully
C:\Users\PC\AppData\Local\Mozilla\Firefox\Profiles\tpn5t8ls.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=10 folders=11 7620998 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\PC\AppData\Local\Temp will be emptied at reboot
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\PC\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6BGVHFPN" not found

==== EOF on po 08.05.2017 at 22:26:28,94 ======================
























~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.3 (04.10.2017)
Operating System: Windows 7 Professional x64
Ran by PC (Administrator) on po 08.05.2017 at 22:28:36,35
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 8

Failed to delete: C:\Users\PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYDIBV3Q (Temporary Internet Files Folder)
Successfully deleted: C:\Users\PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3JDI6TO5 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HKITXMWH (Temporary Internet Files Folder)
Successfully deleted: C:\Users\PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PITG32Q8 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3JDI6TO5 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYDIBV3Q (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HKITXMWH (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PITG32Q8 (Temporary Internet Files Folder)



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on po 08.05.2017 at 22:31:14,09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of random's system information tool 1.16 (written by random/random)
Run by PC at 2017-05-08 22:43:25
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 230 GB (75%) free of 305 GB
Total RAM: 3871 MB (59% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:43:35, on 8.5.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18639)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
C:\Program Files\trend micro\PC_RSITx64.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.cz/?gfe_rd=cr&ei=_f8 ... =ssl#spf=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll
O4 - HKLM\..\Run: [PWMTRV] rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [IMSS] "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [RotateImage] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files (x86)\Digital Line Detect\DLG.exe
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{188F5398-8881-43B3-ADA8-B61A7DFF6BE0}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{1EDAEE71-673D-4DF0-9D04-E2034A310C93}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{202E7AAF-2584-40D3-9169-60B6DAD619DF}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{29AF921B-5F20-4AAE-9A4A-BCA5F2DEF44D}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{30D86D8B-2C59-46E0-8B60-06DA6DF1E266}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{3348A0D7-4558-491F-81CE-7C6F110DA21E}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A20815E-01EC-4BD4-9EF8-9234B1B147ED}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{605F2096-7325-42DB-A22C-13C053B03D20}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{846ee342-7039-11de-9d20-806e6f6e6963}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A17FC28-21DF-45A4-98FA-0AED85926008}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{A23611C8-B1EA-4076-8E53-64E7149BF592}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{FFBE0C14-C8BE-48E3-84B4-DE53BB435A57}: NameServer = 8.8.8.8
O17 - HKLM\System\CS1\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O17 - HKLM\System\CS2\Services\Tcpip\..\{0A35D569-E82C-4639-9595-AC02F8319B6F}: NameServer = 8.8.8.8
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Identity Protection Technology Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo EasyPlus Hotspot - Lenovo - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Lenovo Platform Service (LPlatSvc) - Unknown owner - C:\Windows\system32\LPlatSvc.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: Power Manager Service (Power Manager DBC Service) - Lenovo - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Samsung UPD Utility Service (SamsungUPDUtilSvc) - Unknown owner - C:\Windows\SysWOW64\SecUPDUtilSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ShareItSvc - SHAREit Technologies Co.Ltd - C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files (x86)\Lenovo\System Update\SUService.exe
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10480 bytes

====== Enumerating Processes ======

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ibmpmsvc.exe
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\system32\winlogon.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k HsfXAudioService
"C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe"
"C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe"
"C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe"
C:\Windows\SysWOW64\SecUPDUtilSvc.exe
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
"c:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
"C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"C:\Windows\System32\hkcmd.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"c:\program files (x86)\teamviewer\TeamViewer_Desktop.exe" --IPCport 5939
"C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe" -Embedding
"C:\Program Files (x86)\Lenovo\System Update\SUService.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE"
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
"C:\Users\PC\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

====== Scheduled tasks folder ======

C:\Windows\system32\tasks\Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\system32\tasks\Adobe Flash Player Updater - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\system32\tasks\klcp_update - "C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe" /verysilent /update /freq=30
C:\Windows\system32\tasks\PMTask - C:\Program Files (x86)\ThinkPad\Utilities\PwmIdTsv.exe
C:\Windows\system32\tasks\SidebarExecute - C:\Program Files (x86)\Windows Sidebar\sidebar.exe /showGadgets
C:\Windows\system32\tasks\Synaptics TouchPad Enhancements - \Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\tasks\{0D1AEFEE-2309-F090-AF3D-12B63B9FF166} - C:\Windows\system32\regsvr32.exe /s /n /i:"/rt" "C:\PROGRA~3\207d4732\768720c1.dll"
C:\Windows\system32\tasks\{87EB3D5C-6FA0-4A1D-83AA-B32F937AD1B7} - "c:\program files (x86)\mozilla firefox\firefox.exe" http://ui.skype.com/ui/0/7.23.0.105/cs/ ... =tsInstall
C:\Windows\system32\tasks\WPD\SqmUpload_S-1-5-21-1790732064-3310509644-602799907-1000 - %windir%\system32\rundll32.exe portabledeviceapi.dll,#1
C:\Windows\system32\tasks\TVT\TVSUUpdateTask - "C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe" /CM -search C -action INSTALL -includerebootpackages 1,3,4 -noicon -noreboot -nolicense -defaultupdate -schtask
C:\Windows\system32\tasks\TVT\TVSUUpdateTask_UserLogOn - "C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe" PendingTask
C:\Windows\system32\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask - %systemroot%\system32\sc.exe start osppsvc
C:\Windows\system32\tasks\Microsoft\Windows\WindowsBackup\ConfigNotification - %systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
C:\Windows\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\Windows\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\Windows\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -queuereporting
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask - %SystemRoot%\system32\Wat\WatAdminSvc.exe /run
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline - %SystemRoot%\system32\schtasks.exe /run /I /TN "\Microsoft\Windows\Windows Activation Technologies\ValidationTask"
C:\Windows\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\Windows\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
C:\Windows\system32\tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask - sc.exe start sppsvc
C:\Windows\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\Windows\system32\tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem - %SystemRoot%\System32\powercfg.exe -energy -auto
C:\Windows\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\Windows\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService - %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks - %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ehDRMInit - %SystemRoot%\ehome\ehPrivJob.exe /DRMInit
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\InstallPlayReady - %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\mcupdate - %SystemRoot%\ehome\mcupdate $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURActivate - %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURDiscovery - %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscovery - %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 - %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 - %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PeriodicScanRetry - %windir%\ehome\MCUpdate.exe -pscn 0
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrScheduleTask - %SystemRoot%\ehome\mcupdate.exe -PvrSchedule
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RecordingRestart - %SystemRoot%\ehome\ehrec /RestartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RegisterSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ReindexSearchRoot - %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\StartRecording - %SystemRoot%\ehome\ehrec /StartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\UpdateRecordPath - %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotifications.exe
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\Windows\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\Windows\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\AitAgent - aitagent
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattel\DiagTrackRunner.exe /UploadEtlFilesOnly
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\Windows\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\Windows\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe
C:\Windows\system32\tasks\Microsoft\Office\Office 15 Subscription Heartbeat - %ProgramFiles%\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
C:\Windows\system32\tasks\Microsoft\Office\OfficeTelemetryAgentFallBack - "C:\Program Files\Microsoft Office\Office15\msoia.exe" scan upload mininterval:2880
C:\Windows\system32\tasks\Microsoft\Office\OfficeTelemetryAgentLogOn - "C:\Program Files\Microsoft Office\Office15\msoia.exe" scan upload
C:\Windows\system32\tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan - c:\Program Files\Microsoft Security Client\\MpCmdRun.exe Scan -ScheduleJob -RestrictPrivileges
C:\Windows\system32\tasks\Lenovo\Lenovo Customer Feedback Program 64 - "%ProgramFiles(x86)%\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe"
C:\Windows\system32\tasks\Lenovo\Lenovo Customer Feedback Program 64 35 - "%ProgramFiles(x86)%\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe"
C:\Windows\system32\tasks\Lenovo\Message Center Plus Launcher - "%programfiles(x86)%\Lenovo\message center plus\mcplaunch.exe" /start
C:\Windows\system32\tasks\AVAST Software\Avast settings backup - C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe /backup /iavs

=========Mozilla firefox=========

ProfilePath - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default

prefs.js - "browser.startup.homepage" - "about:home"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.148 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_148.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\SysWOW64\Adobe\Director\np32dsw_1224194.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]
"Description"=This plugin updates Intel WebAPI component
"Path"=C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.131.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.131.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_131\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/Lync,version=15.0]
"Description"=Microsoft Lync Plug-in for Firefox
"Path"=C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nokia.com/EnablerPlugin]
"Description"=Nokia Suite Enabler Plugin
"Path"=C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.148 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_148.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.131.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.131.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre1.8.0_131\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.2.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll


C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default\addons.json
Mozilla Firefox hotfix - extension - firefox-hotfix@mozilla.org

C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default\extensions.json
Application Update Service Helper - extension - aushelper@mozilla.org - C:\Program Files\Mozilla Firefox\browser\features\aushelper@mozilla.org.xpi
Multi-process staged rollout - extension - e10srollout@mozilla.org - C:\Program Files\Mozilla Firefox\browser\features\e10srollout@mozilla.org.xpi
Pocket - extension - firefox@getpocket.com - C:\Program Files\Mozilla Firefox\browser\features\firefox@getpocket.com.xpi
Web Compat - extension - webcompat@mozilla.org - C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi
Default - theme - {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi
Shield Recipe Client - extension - shield-recipe-client@mozilla.org - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default\features\{e38fabb0-0e6a-4a81-a947-0d5eeacbb6c5}\shield-recipe-client@mozilla.org.xpi

C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\pcfxdrmr.default\pluginreg.dat
Plugin - Shockwave Flash - 25.0.0.148 - C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_148.dll

=========Google Chrome=========

C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Extension ahfgeienlihckogmohjhadlkjgocpleb 1 Obchod Chrome 0.2
Extension aohghmighlieiainnegkcijnfilokake 1 Docs 0.0.0.6
Extension apdfllckaahabafndbhieahigkjlhalf 1 Disk Google 6.2
Extension bepbmhgboaologfdajaanbcjmnhjmhfn 0
Extension blpcfgokakmgnkcojhhkbfbldkacnbeo 1 YouTube 4.2.5
Extension eemcgdkfndhakfknompkggombfjjjeno 1 Bookmark Manager 0.1
Extension gfdkimpbcpahaombhbimeihdjnejgicl 1 Feedback 1.0
Extension kmendfapggjehodndflmmgagdbamhnfd 1 CryptoTokenExtension 0.9.46
Extension mfehgcgbbipciphmccgaenjidiccnmng 1 Cloud Print 0.1
Extension mhjfbmdgcfjbbpaeojofohoefgiehjai 1 Chrome PDF Viewer 1
Extension neajdppkdcdipfabeoofebfddakdcjhd 1 Google Network Speech 1.0
Extension nkeimhogjdpnpccoofpliimaahmaaome 1 Google Hangouts 1.3.2
Extension pjkljhegncpnkpknbcohdijeoejaedia 1 Gmail 7
Homepage:
default_search_provider.search_url:
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Preferences
Homepage:
default_search_provider.search_url:

======Registry dump ======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2017-03-14 229064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_131\bin\ssv.dll [2017-04-24 571456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-04-24 234560]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll [2017-04-24 473152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL [2017-02-23 1743664]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-04-24 186944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SAIICpl.exe [2009-11-15 307768]
"LENOVO.TPKNRRES"=C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [2013-05-29 60920]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2016-03-02 183216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2016-03-02 411056]
"Persistence"=C:\Windows\system32\igfxpers.exe [2016-03-02 453544]
"CDAServer"=C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [2014-09-08 464608]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2016-11-14 1353680]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2017-03-14 27545048]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"PWMTRV"=rundll32 C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL,PwrMgrBkGndMonitor []
"IMSS"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [2013-07-02 113656]
"RotateImage"=C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [2008-10-30 55808]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
Digital Line Detect.lnk - C:\Program Files (x86)\Digital Line Detect\DLG.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\System32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2016-03-02 451584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages" = scecli
C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableCAD"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"StubPath" = "C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.96\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux1"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"wave9"=wdmaud.drv
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv
"aux3"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

====== File associations ======

.ini - open - "%SystemRoot%\system32\NOTEPAD.EXE" %1
.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - "%SystemRoot%\system32\NOTEPAD.EXE" %1

====== List of files/folders created in the last 1 month ======

2017-05-08 22:26:35 ----SHD---- C:\$RECYCLE.BIN
2017-05-08 22:24:34 ----A---- C:\Windows\zoek-delete.exe
2017-05-08 22:24:33 ----D---- C:\Windows\Temp
2017-05-08 20:42:47 ----D---- C:\zoek_backup
2017-05-08 19:44:03 ----D---- C:\Users\PC\AppData\Roaming\Mozilla
2017-05-08 19:43:52 ----D---- C:\Program Files\Mozilla Firefox
2017-05-08 16:23:06 ----D---- C:\_OTM
2017-05-08 11:41:15 ----D---- C:\AdwCleaner
2017-05-08 11:22:44 ----D---- C:\rsit
2017-05-08 11:22:44 ----D---- C:\Program Files\trend micro
2017-05-08 10:54:45 ----A---- C:\ComboFix.txt
2017-05-08 10:41:23 ----A---- C:\Windows\zip.exe
2017-05-08 10:41:23 ----A---- C:\Windows\SWSC.exe
2017-05-08 10:41:23 ----A---- C:\Windows\SWREG.exe
2017-05-08 10:41:23 ----A---- C:\Windows\sed.exe
2017-05-08 10:41:23 ----A---- C:\Windows\PEV.exe
2017-05-08 10:41:23 ----A---- C:\Windows\NIRCMD.exe
2017-05-08 10:41:23 ----A---- C:\Windows\MBR.exe
2017-05-08 10:41:23 ----A---- C:\Windows\grep.exe
2017-05-08 10:39:50 ----D---- C:\Qoobox
2017-05-08 10:39:28 ----D---- C:\Windows\erdnt
2017-05-07 19:52:04 ----D---- C:\Program Files (x86)\MozBackup
2017-05-06 19:06:24 ----D---- C:\Program Files\Common Files\adaware
2017-05-06 19:05:40 ----D---- C:\ProgramData\Lavasoft
2017-05-06 15:11:25 ----D---- C:\ProgramData\Spybot - Search & Destroy
2017-05-06 15:11:08 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-05-06 14:40:46 ----D---- C:\Program Files\61GIPRPJJP
2017-05-06 14:34:24 ----D---- C:\Program Files\ID6PRZNMNG
2017-05-06 14:34:18 ----D---- C:\Program Files\B8U9ZQ4633
2017-05-06 14:34:12 ----D---- C:\Program Files\I091IWDH8V
2017-04-24 22:13:26 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-64.dll
2017-04-12 21:41:51 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2017-04-12 21:41:51 ----A---- C:\Windows\system32\rdpcorets.dll
2017-04-12 21:41:50 ----A---- C:\Windows\system32\mshtml.dll
2017-04-12 21:41:49 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-04-12 21:41:48 ----A---- C:\Windows\system32\ieframe.dll
2017-04-12 21:41:46 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-04-12 21:41:45 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-04-12 21:41:45 ----A---- C:\Windows\system32\wininet.dll
2017-04-12 21:41:44 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-04-12 21:41:44 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\wuaueng.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\win32k.sys
2017-04-12 21:41:44 ----A---- C:\Windows\system32\urlmon.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\ole32.dll
2017-04-12 21:41:44 ----A---- C:\Windows\system32\iertutil.dll
2017-04-12 21:41:43 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-04-12 21:41:43 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\wucltux.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\wuapi.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\win32spl.dll
2017-04-12 21:41:43 ----A---- C:\Windows\system32\samsrv.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\ucrtbase.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\quartz.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\msfeeds.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\cdosys.dll
2017-04-12 21:41:42 ----A---- C:\Windows\system32\atmfd.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\quartz.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2017-04-12 21:41:41 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2017-04-12 21:41:41 ----A---- C:\Windows\system32\gdi32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\ucrtbase.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\iedkcs32.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 21:41:40 ----A---- C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 21:41:39 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l2-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\jscript.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 21:41:39 ----A---- C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-12 21:41:38 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-04-12 21:41:38 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-04-12 21:41:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-04-12 21:41:36 ----A---- C:\Windows\system32\ntdll.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\mfmjpegdec.dll
2017-04-12 21:41:35 ----A---- C:\Windows\SYSWOW64\asycfilt.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\webcheck.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\samlib.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\mfmjpegdec.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\jscript9.dll
2017-04-12 21:41:35 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-04-12 21:41:35 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-04-12 21:41:35 ----A---- C:\Windows\system32\asycfilt.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\samlib.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-04-12 21:41:34 ----A---- C:\Windows\SYSWOW64\cdosys.dll
2017-04-12 21:41:34 ----A---- C:\Windows\system32\rdpudd.dll
2017-04-12 21:41:34 ----A---- C:\Windows\system32\ie4uinit.exe
2017-04-12 21:41:34 ----A---- C:\Windows\system32\certcli.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\wups.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wuwebv.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wups2.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wups.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\wudriver.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\vbscript.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\srcore.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\rpcrt4.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-04-12 21:41:33 ----A---- C:\Windows\system32\ieapfltr.dll
2017-04-12 21:41:32 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2017-04-12 21:41:32 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\wuauclt.exe
2017-04-12 21:41:32 ----A---- C:\Windows\system32\lsasrv.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\ieui.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\dxtrans.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\dxtmsft.dll
2017-04-12 21:41:32 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-04-12 21:41:31 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\srclient.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\smss.exe
2017-04-12 21:41:31 ----A---- C:\Windows\system32\msrating.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\mshtmled.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\kerberos.dll
2017-04-12 21:41:31 ----A---- C:\Windows\system32\advapi32.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\WinSetupUI.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\rstrui.exe
2017-04-12 21:41:30 ----A---- C:\Windows\system32\occache.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\kernel32.dll
2017-04-12 21:41:30 ----A---- C:\Windows\system32\jscript9diag.dll
2017-04-12 21:41:29 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\schannel.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-12 21:41:29 ----A---- C:\Windows\system32\jsproxy.dll
2017-04-12 21:41:29 ----A---- C:\Windows\system32\ieUnatt.exe
2017-04-12 21:41:29 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-04-12 21:41:29 ----A---- C:\Windows\system32\conhost.exe
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-04-12 21:41:28 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\wow64win.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\winsrv.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\ncrypt.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\msv1_0.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\KernelBase.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\inseng.dll
2017-04-12 21:41:28 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-04-12 21:41:27 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\wuapp.exe
2017-04-12 21:41:27 ----A---- C:\Windows\system32\wdigest.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\TSpkg.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\sspicli.dll
2017-04-12 21:41:27 ----A---- C:\Windows\system32\iesetup.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-04-12 21:41:26 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\wow64.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\rpchttp.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\iernonce.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-04-12 21:41:26 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-04-12 21:41:26 ----A---- C:\Windows\system32\csrsrv.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\cdd.dll
2017-04-12 21:41:26 ----A---- C:\Windows\system32\bcrypt.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-04-12 21:41:25 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-04-12 21:41:25 ----A---- C:\Windows\system32\drivers\appid.sys
2017-04-12 21:41:25 ----A---- C:\Windows\system32\cryptbase.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-04-12 21:41:24 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\wow64cpu.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\sspisrv.dll
2017-04-12 21:41:24 ----A---- C:\Windows\system32\lsass.exe
2017-04-12 21:41:24 ----A---- C:\Windows\system32\lpk.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-04-12 21:41:23 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\secur32.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\fontsub.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\dciman32.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\appidsvc.dll
2017-04-12 21:41:23 ----A---- C:\Windows\system32\appidapi.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 21:41:22 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\lpk.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2017-04-12 21:41:22 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\ntvdm64.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\credssp.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\auditpol.exe
2017-04-12 21:41:22 ----A---- C:\Windows\system32\atmlib.dll
2017-04-12 21:41:22 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-04-12 21:41:22 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 21:41:21 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 21:41:20 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\user.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\tzres.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\tzres.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\msaudite.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\apisetschema.dll
2017-04-12 21:41:20 ----A---- C:\Windows\system32\adtschema.dll
2017-04-12 21:41:19 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-04-12 21:41:19 ----A---- C:\Windows\system32\msobjs.dll
2017-04-12 21:41:19 ----A---- C:\Windows\system32\ieetwcollectorres.dll

====== List of files/folders modified in the last 1 month ======

2017-05-08 22:42:41 ----D---- C:\Windows\system32\config
2017-05-08 22:37:31 ----D---- C:\Users\PC\AppData\Roaming\Skype
2017-05-08 22:36:35 ----D---- C:\Program Files (x86)\TeamViewer
2017-05-08 22:36:33 ----D---- C:\Windows\System32
2017-05-08 22:36:33 ----D---- C:\Windows\inf
2017-05-08 22:36:33 ----D---- C:\Windows
2017-05-08 22:28:52 ----SHD---- C:\System Volume Information
2017-05-08 22:27:42 ----A---- C:\Windows\SYSWOW64\log.txt
2017-05-08 21:54:30 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-05-08 21:50:11 ----D---- C:\Windows\system32\drivers\etc
2017-05-08 21:49:03 ----D---- C:\Windows\SysWOW64
2017-05-08 21:48:31 ----RD---- C:\Program Files
2017-05-08 21:48:31 ----D---- C:\ProgramData
2017-05-08 21:48:30 ----D---- C:\Windows\system32\drivers
2017-05-08 21:47:19 ----D---- C:\Windows\Prefetch
2017-05-08 21:45:54 ----D---- C:\Program Files (x86)\Mozilla Firefox
2017-05-08 21:02:01 ----HD---- C:\Windows\system32\GroupPolicy
2017-05-08 20:48:19 ----RD---- C:\Program Files (x86)
2017-05-08 10:50:58 ----A---- C:\Windows\system.ini
2017-05-08 10:46:50 ----D---- C:\Windows\SYSWOW64\drivers
2017-05-08 10:46:50 ----D---- C:\Windows\AppPatch
2017-05-08 10:46:49 ----D---- C:\Program Files (x86)\Common Files
2017-05-07 20:50:25 ----SHD---- C:\Windows\Installer
2017-05-07 20:46:01 ----D---- C:\Program Files (x86)\Google
2017-05-07 20:45:22 ----D---- C:\Windows\system32\Tasks
2017-05-07 17:18:40 ----D---- C:\Windows\Tasks
2017-05-07 16:46:45 ----RSD---- C:\Windows\Fonts
2017-05-07 16:46:44 ----D---- C:\Users\PC\AppData\Roaming\TeamViewer
2017-05-07 08:23:43 ----SD---- C:\ProgramData\Microsoft
2017-05-06 19:06:24 ----D---- C:\Program Files\Common Files
2017-05-06 15:30:17 ----D---- C:\Program Files\Common Files\AV
2017-05-06 15:03:48 ----D---- C:\Windows\Panther
2017-05-06 15:03:47 ----D---- C:\Windows\Logs
2017-05-06 15:03:46 ----D---- C:\Windows\Minidump
2017-05-06 15:03:46 ----D---- C:\Windows\debug
2017-05-06 13:25:29 ----D---- C:\ProgramData\Microsoft Help
2017-05-06 13:24:45 ----RSD---- C:\Windows\assembly
2017-05-01 19:32:10 ----D---- C:\Windows\system32\catroot2
2017-04-24 23:40:45 ----D---- C:\ProgramData\Oracle
2017-04-24 22:13:39 ----D---- C:\Program Files (x86)\Java
2017-04-24 22:13:23 ----D---- C:\Program Files\Java
2017-04-24 22:12:24 ----A---- C:\Windows\system32\WindowsAccessBridge-64.dll
2017-04-24 22:11:19 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2017-04-13 19:12:15 ----D---- C:\Windows\LiveKernelReports
2017-04-13 08:08:55 ----D---- C:\Windows\rescache
2017-04-13 07:29:53 ----D---- C:\Windows\winsxs
2017-04-13 07:26:53 ----D---- C:\Windows\SYSWOW64\en-US
2017-04-13 07:26:53 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-04-13 07:26:53 ----D---- C:\Program Files\Internet Explorer
2017-04-13 07:26:51 ----D---- C:\Windows\system32\en-US
2017-04-13 07:26:51 ----D---- C:\Windows\system32\cs-CZ
2017-04-13 07:26:50 ----D---- C:\Windows\system32\Boot
2017-04-13 07:26:50 ----D---- C:\Program Files (x86)\Internet Explorer
2017-04-13 07:08:33 ----D---- C:\Program Files\Microsoft Silverlight
2017-04-13 07:08:33 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2017-04-13 07:07:25 ----D---- C:\Windows\Microsoft.NET
2017-04-13 07:06:53 ----D---- C:\Windows\system32\MRT
2017-04-13 06:57:53 ----AC---- C:\Windows\system32\MRT.exe
2017-04-13 06:53:01 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-04-12 07:43:58 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2017-04-12 07:43:52 ----D---- C:\Windows\system32\Macromed
2017-04-12 07:43:50 ----D---- C:\Windows\SYSWOW64\Macromed

File C:\Windows\system32\winlogon.exe is digitally signed
File C:\Windows\system32\wininit.exe is digitally signed
File C:\Windows\explorer.exe is digitally signed
File C:\Windows\SysWOW64\explorer.exe is digitally signed
File C:\Windows\system32\svchost.exe is digitally signed
File C:\Windows\SysWOW64\svchost.exe is digitally signed
File C:\Windows\system32\services.exe is digitally signed
File C:\Windows\system32\User32.dll is digitally signed
File C:\Windows\SysWOW64\User32.dll is digitally signed
File C:\Windows\system32\userinit.exe is digitally signed
File C:\Windows\SysWOW64\userinit.exe is digitally signed
File C:\Windows\system32\rpcss.dll is digitally signed
File C:\Windows\system32\Drivers\volsnap.sys is digitally signed

====== List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R0 DzHDD64;DzHDD64; C:\Windows\System32\DRIVERS\DzHDD64.sys [2016-04-14 29512]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2012-05-30 569152]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2016-08-25 295000]
R0 nvpciflt;nvpciflt; C:\Windows\system32\DRIVERS\nvpciflt.sys [2013-10-29 30496]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiifx64.sys [2013-05-22 15472]
R1 nvkflt;nvkflt; C:\Windows\system32\DRIVERS\nvkflt.sys [2013-10-29 284448]
R1 TPPWRIF;TPPWRIF; C:\Windows\System32\drivers\Tppwr64v.sys [2016-04-14 29008]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 17024]
R2 risdxc;risdxc; C:\Windows\system32\DRIVERS\risdxc64.sys [2011-05-25 101888]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2014-05-07 11576]
R3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2011-03-04 166016]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 btwampfl;btwampfl Bluetooth filter driver; \??\C:\Windows\system32\drivers\btwampfl.sys [2012-12-04 598808]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2012-05-02 184144]
R3 btwavdt;Bluetooth AVDT; C:\Windows\system32\DRIVERS\btwavdt.sys [2012-03-06 210984]
R3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2011-09-18 39976]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2012-03-06 21544]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2012-06-04 1580704]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2015-10-29 506880]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2016-09-06 82232]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2016-03-02 5384728]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2012-11-09 57376]
R3 NETw5s64;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2016-08-25 135928]
R3 psadd;Lenovo Parties Service Access Device Driver; C:\Windows\system32\DRIVERS\psadd.sys [2009-12-08 37440]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RtlvVga;RtlvVga; C:\Windows\system32\DRIVERS\RtlvVga.sys [2014-03-18 11920]
R3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2014-07-28 45296]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-14 12288]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2014-07-28 461552]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmpx64.sys [2009-09-03 67072]
S2 rimspci;rimspci; C:\Windows\system32\DRIVERS\rimspe64.sys [2009-10-26 61952]
S2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimspx64.sys [2009-09-03 54784]
S2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdpx64.sys [2009-09-03 57856]
S3 ATSwpWDF;AuthenTec TruePrint USB Driver; C:\Windows\System32\Drivers\ATSwpWDF.sys [2010-02-05 736840]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 btusbflt;Bluetooth USB Filter; C:\Windows\system32\drivers\btusbflt.sys [2010-04-09 54824]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CAXHWAZL;CAXHWAZL; C:\Windows\system32\DRIVERS\CAXHWAZL.sys [2009-06-30 292864]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K; C:\Windows\system32\DRIVERS\e1k62x64.sys [2011-07-20 342704]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver; C:\Windows\system32\DRIVERS\e1y62x64.sys [2010-04-07 290008]
S3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2012-11-09 57376]
S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\CAX_DPV.sys [2009-06-30 1486848]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2013-01-23 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2013-01-23 27136]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2013-02-25 194848]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2012-10-17 26112]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter; C:\Windows\system32\DRIVERS\rtwlane.sys [2015-01-06 3709656]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-21 109056]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2013-01-23 9216]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 usbser;USB Modem Driver; C:\Windows\system32\DRIVERS\usbser.sys [2013-08-29 33280]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2013-01-23 9216]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]

====== List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-04-25 83056]
R2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe [2013-05-14 1008344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\cscsvc.dll
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; %SystemRoot%\System32\svchost.exe -k utcsvc;"ServiceDll" = %SystemRoot%\system32\diagtrack.dll
R2 HsfXAudioService;HsfXAudioService; %SystemRoot%\system32\svchost.exe -k HsfXAudioService;"ServiceDll" = C:\Windows\SysWOW64\XAudio64.dll
R2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2016-09-06 180736]
R2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service; C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [2014-07-09 214464]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute; C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [2013-05-29 44024]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-05-27 110128]
R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction; C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2013-05-29 62456]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-07-02 327672]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2016-11-14 119864]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-10-29 893216]
R2 SamsungUPDUtilSvc;Samsung UPD Utility Service; C:\Windows\SysWOW64\SecUPDUtilSvc.exe [2016-05-22 143664]
R2 TeamViewer;TeamViewer 12; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2017-04-25 10888944]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 125424]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2014-05-27 125488]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2013-07-02 2595832]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2016-11-14 361816]
R3 Power Manager DBC Service;Power Manager Service; C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2016-04-14 1668776]
R3 SUService;System Update; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [2017-01-18 23416]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-03-20 105096]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-03-20 125064]
S2 gupdate;Služba Aktualizace Google (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-07 153168]
S2 LPlatSvc;Lenovo Platform Service; C:\Windows\system32\LPlatSvc.exe [2016-09-06 710144]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2017-01-16 317400]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-12 271448]
S3 AppMgmt;@appmgmts.dll,-3250; %SystemRoot%\system32\svchost.exe -k netsvcs;"ServiceDll" = %SystemRoot%\System32\appmgmts.dll
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2016-03-02 290224]
S3 DozeSvc;Lenovo Doze Mode Service; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2016-04-14 326160]
S3 gupdatem;Služba Aktualizace Google (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-07 153168]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-03-25 114688]
S3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [2014-12-05 619776]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-12-08 178760]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 5132888]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; %SystemRoot%\System32\svchost.exe -k PeerDist;"ServiceDll" = %SystemRoot%\system32\peerdistsvc.dll
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2013-04-18 737616]
S3 ShareItSvc;ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [2016-01-20 31176]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\system32\storsvc.dll
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\umrdp.dll
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2015-01-15 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-03-20 51320]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]

-----------------EOF-----------------

Nastala po skenu Zoek a Junkware nějaká změna?

Bohuzel nenastala, pri otevreni FF prvni stranka se nacte, dalsi zalozky jiz ne. V IE a Chrome se nenacte ani prvni.
Jeste vim, ze na zacatku bzl naistalovan nejakz skodlivy software yeadesktop, ktery to podle me vse zpusobil. Nainstaloval do vsech prohlizecu startovaci stranku yeadesktop.com. To se mi casem povedlo odstranit(byl napriklad v ceste k souboru v zastupci prohlizece). Ale mozna tam nekde nejake zbytky jeste jsou.